CVE-2018-1099

DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).

Score

CVSS 3.0 5.5 Medium

Status

Modified - secalert@redhat.com

Published

2018-04-03

Last modified

2024-09-17

Weaknesses

CWE-20

Affected products

• Fedora (Fedoraproject)
• Etcd (Red Hat Inc.)
• Etcd (Redhat)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1552717
• https://github.com/coreos/etcd/issues/9353
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RA…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3X…