CVE-2020-15136

Name	CVE-2020-15136
Description	In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	968752

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
etcd (PTS)	buster (security), buster, buster (lts)	3.2.26+dfsg-3+deb10u1	vulnerable
	bullseye	3.3.25+dfsg-6	fixed
	bookworm	3.4.23-4	fixed
	sid, trixie	3.5.16-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
etcd	source	experimental	3.3.25+dfsg-1
etcd	source	(unstable)	3.3.25+dfsg-5			968752

[buster] - etcd <no-dsa> (Minor issue)
https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q