CVE-2021-28235

一、漏洞信息
 漏洞编号：[CVE-2021-28235](https://nvd.nist.gov/vuln/detail/CVE-2021-28235)
 漏洞归属组件：[etcd](https://gitee.com/src-openeuler/etcd)
 漏洞归属的版本：3.4.14,3.4.7
 CVSS V3.0分值：
  BaseScore：9.8 Critical
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.
 漏洞公开时间：2023-04-04 23:15:08
 漏洞创建时间：2023-04-04 21:12:27
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-28235
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | https://github.com/etcd-io/etcd |  |
| cve.mitre.org | https://github.com/etcd-io/etcd/pull/15648 |  |
| cve.mitre.org | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png |  |
| cve.mitre.org | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-28235 | https://bugzilla.suse.com/show_bug.cgi?id=1210138 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2184441 | https://bugzilla.suse.com/show_bug.cgi?id=1210138 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2021-28235 | https://bugzilla.suse.com/show_bug.cgi?id=1210138 |
| suse_bugzilla | http://etcd.com | https://bugzilla.suse.com/show_bug.cgi?id=1210138 |
| suse_bugzilla | https://github.com/etcd-io/etcd | https://bugzilla.suse.com/show_bug.cgi?id=1210138 |
| suse_bugzilla | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png | https://bugzilla.suse.com/show_bug.cgi?id=1210138 |
| suse_bugzilla | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png | https://bugzilla.suse.com/show_bug.cgi?id=1210138 |
| redhat_bugzilla | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png | https://bugzilla.redhat.com/show_bug.cgi?id=2184441 |
| redhat_bugzilla | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png | https://bugzilla.redhat.com/show_bug.cgi?id=2184441 |
| redhat_bugzilla | http://etcd.com | https://bugzilla.redhat.com/show_bug.cgi?id=2184441 |
| redhat_bugzilla | https://github.com/etcd-io/etcd | https://bugzilla.redhat.com/show_bug.cgi?id=2184441 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:3441 | https://bugzilla.redhat.com/show_bug.cgi?id=2184441 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:3445 | https://bugzilla.redhat.com/show_bug.cgi?id=2184441 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:3447 | https://bugzilla.redhat.com/show_bug.cgi?id=2184441 |
| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2021-28235 | https://bugzilla.redhat.com/show_bug.cgi?id=2184441 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2021-28235 |
| cve_search |  | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png |
| cve_search |  | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png |
| cve_search |  | http://etcd.com |
| cve_search |  | https://github.com/etcd-io/etcd |
| github_advisory | https://nvd.nist.gov/vuln/detail/CVE-2021-28235 | https://github.com/advisories/GHSA-gmph-wf7j-9gcm |
| github_advisory | https://github.com/etcd-io/etcd | https://github.com/advisories/GHSA-gmph-wf7j-9gcm |
| github_advisory | https://github.com/etcd-io/etcd/pull/15648 | https://github.com/advisories/GHSA-gmph-wf7j-9gcm |
| github_advisory | http://etcd.com | https://github.com/advisories/GHSA-gmph-wf7j-9gcm |
| github_advisory | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png | https://github.com/advisories/GHSA-gmph-wf7j-9gcm |
| github_advisory | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png | https://github.com/advisories/GHSA-gmph-wf7j-9gcm |
| osv | http://etcd.com | https://osv.dev/vulnerability/CVE-2021-28235 |
| osv | https://github.com/etcd-io/etcd | https://osv.dev/vulnerability/CVE-2021-28235 |
| osv | https://github.com/etcd-io/etcd/pull/15648 | https://osv.dev/vulnerability/CVE-2021-28235 |
| osv | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png | https://osv.dev/vulnerability/CVE-2021-28235 |
| osv | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png | https://osv.dev/vulnerability/CVE-2021-28235 |
| snyk | https://github.com/etcd-io/etcd/pull/15655/commits/3618ab4b07cc9c0883b6a642da198877e25d612b | https://security.snyk.io/vuln/SNYK-GOLANG-GOETCDIOETCDV3ETCDSERVER-5418289 |
| snyk | https://github.com/etcd-io/etcd/pull/15648 | https://security.snyk.io/vuln/SNYK-GOLANG-GOETCDIOETCDV3ETCDSERVER-5418289 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/etcd-io/etcd/pull/15648 |  | cve.mitre.org |
|  |  | https://github.com/etcd-io/etcd/pull/15648 |  | github_advisory |
|  |  | https://github.com/etcd-io/etcd/pull/15648 |  | osv |
|  |  | https://github.com/etcd-io/etcd/pull/15655/commits/3618ab4b07cc9c0883b6a642da198877e25d612b |  | snyk |
|  |  | https://github.com/etcd-io/etcd/pull/15648 |  | snyk |
|  |  | https://github.com/etcd-io/etcd |  | nvd |
|  |  | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png |  | nvd |
|  |  | https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  在Etcd-io版本3.4.10中发现了一个认证漏洞，该漏洞允许远程攻击者通过调试功能提升权限。这种类型的漏洞可能使得未经授权的用户能够访问或修改他们本不应有权访问的数据或设置，从而对系统的安全性和稳定性构成威胁。 上游相关patch解决方案:https://github.com/etcd-io/etcd/pull/15648/files#diff-dc4444d61a2f7e5ebda2815d4824d4842d5949d351bfb1d9d68eb5ceacf8d7fd
 openEuler评分：
  9.8
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(3.4.14):受影响
2.openEuler-20.03-LTS-SP3:受影响
3.openEuler-22.03-LTS(3.4.14):受影响
4.openEuler-22.03-LTS-SP1(3.4.14):受影响
5.openEuler-22.03-LTS-SP3(3.4.14):受影响
6.openEuler-22.03-LTS-SP4(3.4.14):受影响
7.openEuler-24.03-LTS(3.4.14):不受影响
8.openEuler-24.03-LTS-SP1(3.4.14):不受影响
9.openEuler-24.03-LTS-Next(3.4.14):不受影响
10.master:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1:否
2.openEuler-20.03-LTS-SP4(3.4.14):否
3.openEuler-20.03-LTS-SP3:否
4.openEuler-22.03-LTS(3.4.14):否
5.openEuler-22.03-LTS-SP1(3.4.14):否
6.openEuler-22.03-LTS-SP3(3.4.14):否
7.openEuler-24.03-LTS(3.4.14):否
8.openEuler-24.03-LTS-SP1(3.4.14):否
9.openEuler-24.03-LTS-Next(3.4.14):否
10.openEuler-22.03-LTS-SP4(3.4.14):否
11.master:否

原因说明：
  1.master:
2.openEuler-20.03-LTS-SP4(3.4.14):
3.openEuler-22.03-LTS-SP3(3.4.14):
4.openEuler-22.03-LTS-SP4(3.4.14):
5.openEuler-24.03-LTS(3.4.14):
6.openEuler-24.03-LTS-Next(3.4.14):
7.openEuler-24.03-LTS-SP1(3.4.14):

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1170

src-openEuler/etcd
关闭

内容风险标识

评论 (12)

src-openEuler/etcd关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-28235

评论 (12)

搜索帮助

src-openEuler/etcd
关闭