TI-2020-11890 Aliases CVE-2020-15115 GHSA-4993-m7g5-r9hh

No minimum password length in etcd

LOW 36CWE-521Published 2020-08-06 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-521.

Summary

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.

Why it matters now

EPSS 0.01342 71st percentileScored 2026-11-07

Fix Partial etcd (etcd-io): 3.3.23, 3.4.10go.etcd.io/etcd/client/v3 (Go): 3.4.10, 3.3.23Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
etcd-io	etcd	before 3.3.23; before 3.4.10	3.3.23, 3.4.10	Patch available	CNA
—	go.etcd.io/etcd/client/v3 (Go)	3.4.0 to before 3.4.10	3.4.10	Patch available	GHSA-4993-m7g5-r9hh
—	go.etcd.io/etcd/client/v3 (Go)	before 3.3.23	3.3.23	Patch available	GHSA-4993-m7g5-r9hh

etcd Vendoretcd-io Affected before 3.3.23; before 3.4.10 Fixed in 3.3.23, 3.4.10 Patch available CNA
go.etcd.io/etcd/client/v3 (Go) Vendor— Affected 3.4.0 to before 3.4.10 Fixed in 3.4.10 Patch available GHSA-4993-m7g5-r9hh
go.etcd.io/etcd/client/v3 (Go) Vendor— Affected before 3.3.23 Fixed in 3.3.23 Patch available GHSA-4993-m7g5-r9hh

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:redhat:etcd::::::::	3.3.0 to before 3.3.23; 3.4.0 to before 3.4.10	Vulnerable	Red Hat
cpe:2.3:o:fedoraproject:fedora:32:::::::*	32	Vulnerable	Fedoraproject

cpe:2.3:a:redhat:etcd:*:*:*:*:*:*:*:* Versions 3.3.0 to before 3.3.23; 3.4.0 to before 3.4.10 Vulnerable ·Red Hat
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject

Remediation

Fix · CNA etcd (etcd-io) Fixed in 3.3.23, 3.4.10
Fix · GHSA-4993-m7g5-r9hh go.etcd.io/etcd/client/v3 (Go) Fixed in 3.4.10 Advisory →
Fix · GHSA-4993-m7g5-r9hh go.etcd.io/etcd/client/v3 (Go) Fixed in 3.3.23 Advisory →

Red Hat 1 advisory

RHSA-2021:0916 Released 2021-03-17 · Red Hat rating Moderate
Red Hat OpenStack Platform 16.1.4 (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-1.el8ost

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2020-08-05
etcd-io etcd — FEDORA-2020-cd43b84c16
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2020-11889 Denial of Service in etcdPriority LOW 36
- TI-2020-11909 Improper authentication in etcdPriority LOW 32
- TI-2020-11888 Improper Preservation of Permissions in etcdPriority LOW 31
Show all 6 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 15 (Stein)	Affected	No fix yet: Fix deferred
Red Hat Storage 3	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 16.1	Fixed	RHSA-2021:0916

Not affected: 2 products

Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat OpenShift Container Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2020-15115
2026-10-03 Alias added: GHSA-4993-m7g5-r9hh

References

Advisory 3

Other 2

TI-2021-09444 Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to… CVSS 3.1CRITICAL 9.8
TI-2026-51612 etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline CVSS 4.0HIGH 8.7
TI-2026-25810 etcd: Authorization bypasses in multiple APIs CVSS 4.0HIGH 8.8
TI-2022-15016 Etcd v3.5.4 allows remote attackers to cause a denial of service via function… CVSS 3.1HIGH 7.5
TI-2018-12096 Improper authentication in etcd: CVSS 3.1HIGH 8.1
TI-2026-42635 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation CVSS 3.1HIGH 8.1

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences