medium5.5
CVE-2018-1099
DNS rebinding vulnerability found in etcd 3.3.1 and earlier.
Impact
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Etcd | through 3.3.1 |
| Fedoraproject | Fedora | Version 30 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugzilla.redhat.com/show_bug.cgi?id=1552717
- https://github.com/coreos/etcd/issues/9353
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/
- https://bugzilla.redhat.com/show_bug.cgi?id=1552717
- https://github.com/coreos/etcd/issues/9353
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/