CVEvulnerability
CVE-2018-1099
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-04-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.5 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
Affected configurations
• redhat etcd (<= 3.3.1)
• fedoraproject fedora 30
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1552717 Issue Tracking, Patch, Vendor Advisory
- https://github.com/coreos/etcd/issues/9353 Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/ lists.fedoraproject.org
- https://bugzilla.redhat.com/show_bug.cgi?id=1552717 Issue Tracking, Patch, Vendor Advisory
- https://github.com/coreos/etcd/issues/9353 Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/ lists.fedoraproject.org