GitHub Advisoryadvisory · Go

GHSA-wf43-55jj-vwq8 DNS Rebinding in etcd

MEDIUM Published 2022-02-15 Modified 2021-05-19 Official page ↗
Aliases
CVE-2018-1099
Ecosystem
Go
Packages
go.etcd.io/etcd
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20, CWE-350
Reviewed
2021-05-19

Affected packages

• Go go.etcd.io/etcd: < 3.4.0 → fixed in 3.4.0

Description

DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).

Related

Alias · CVE (1)

  • CVE-2018-1099 DNS rebinding vulnerability found in etcd 3.3.1 and earlier. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action weakness

References