CVE-2020-15115 – etcd before versions 3.3.23 and 3.4.10 does not perform any password leng

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users’ passwords with little computational effort.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15115

Reference (s):

• https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh
• URL: https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh
• FEDORA:FEDORA-2020-cd43b84c16
• URL: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/