Catalogue CVE

CVE-2020-15114

etcd affected and fixed versions

[Catalogue CVE]

In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

Gravité
High · CVSS 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.13% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixieetcd3.3.25+dfsg-5FixedDistribution-reported fixed boundary[CVE-2020-15114]
Debiantrixieetcd3.5.16-4Fixed[CVE-2020-15114]
Debiansidetcd3.3.25+dfsg-5FixedDistribution-reported fixed boundary[CVE-2020-15114]
Debiansidetcd3.5.30-2Fixed[CVE-2020-15114]
Debianforkyetcd3.3.25+dfsg-5FixedDistribution-reported fixed boundary[CVE-2020-15114]
Debianforkyetcd3.5.30-2Fixed[CVE-2020-15114]
Debianbookwormetcd3.3.25+dfsg-5FixedDistribution-reported fixed boundary[CVE-2020-15114]
Debianbookwormetcd3.4.23-4Fixed[CVE-2020-15114]

Showing 8 fix observations. All 24 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormetcd3.3.25+dfsg-5FixedDistribution-reported fixed boundary[CVE-2020-15114]
Debianbookwormetcd3.4.23-4Fixed[CVE-2020-15114]
Debianforkyetcd3.3.25+dfsg-5FixedDistribution-reported fixed boundary[CVE-2020-15114]
Debianforkyetcd3.5.30-2Fixed[CVE-2020-15114]
Debiansidetcd3.3.25+dfsg-5FixedDistribution-reported fixed boundary[CVE-2020-15114]
Debiansidetcd3.5.30-2Fixed[CVE-2020-15114]
Debiantrixieetcd3.3.25+dfsg-5FixedDistribution-reported fixed boundary[CVE-2020-15114]
Debiantrixieetcd3.5.16-4Fixed[CVE-2020-15114]
Ubuntu16.04etcd2.2.0+dfsg-2UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntu16.04etcd2.2.1+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntu16.04etcd2.2.2+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntu16.04etcd2.2.2+dfsg-2UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntu16.04etcd2.2.3+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntu16.04etcd2.2.5+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntu16.04etcd2.2.5+dfsg-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntu20.04etcd3.2.26+dfsg-3UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntu20.04etcd3.2.26+dfsg-4UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntu20.04etcd3.2.26+dfsg-6UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntu20.04etcd3.2.26+dfsg-6ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntuproetcd3.1.0-1UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntuproetcd3.2.17+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntuproetcd3.2.17+dfsg-1ubuntu0.1~esm1UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntuproetcd3.2.9+dfsg-2UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Ubuntuproetcd3.2.9+dfsg-3UnknownSource applicability is not established[UBUNTU-CVE-2020-15114]
Original provider fields
{
  "package_releases": [
    {
      "name": "etcd",
      "status": "fixed",
      "release": "sid",
      "version": "3.5.30-2"
    },
    {
      "name": "etcd",
      "status": "fixed",
      "release": "forky",
      "version": "3.5.30-2"
    },
    {
      "name": "etcd",
      "status": "fixed",
      "release": "trixie",
      "version": "3.5.16-4"
    },
    {
      "name": "etcd",
      "status": "fixed",
      "release": "bookworm",
      "version": "3.4.23-4"
    }
  ],
  "fixed_versions": [
    {
      "bug": 968740,
      "name": "etcd",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.3.25+dfsg-5"
    },
    {
      "bug": 968740,
      "name": "etcd",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "3.3.25+dfsg-5"
    },
    {
      "bug": 968740,
      "name": "etcd",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "3.3.25+dfsg-5"
    },
    {
      "bug": 968740,
      "name": "etcd",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "3.3.25+dfsg-5"
    }
  ],
  "distribution_packages": [
    {
      "name": "etcd",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "2.2.0+dfsg-2",
        "2.2.1+dfsg-1",
        "2.2.2+dfsg-1",
        "2.2.2+dfsg-2",
        "2.2.3+dfsg-1",
        "2.2.5+dfsg-1",
        "2.2.5+dfsg-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-15114",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-15114",
      "provider_updated_at": "2026-02-04T04:29:15.971722Z",
      "applicability_unknown": true
    },
    {
      "name": "etcd",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.17+dfsg-1ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "3.1.0-1",
        "3.2.9+dfsg-2",
        "3.2.9+dfsg-3",
        "3.2.17+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-15114",
      "fixed_version": "3.2.17+dfsg-1ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-15114",
      "provider_updated_at": "2026-02-04T04:29:15.971722Z",
      "applicability_unknown": true
    },
    {
      "name": "etcd",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.26+dfsg-6ubuntu0.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "3.2.26+dfsg-3",
        "3.2.26+dfsg-4",
        "3.2.26+dfsg-6"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-15114",
      "fixed_version": "3.2.26+dfsg-6ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-15114",
      "provider_updated_at": "2026-02-04T04:29:15.971722Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #968740]

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

  • [etcd-client]Inconnu

    Paquet source: [etcd]

    Détails (2)

    • 3.4.23-4+b4 · amd64 · bookworm

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · bookworm; dsa · etcd · debian · 12

    • 3.4.23-4+b4 · arm64 · bookworm

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · bookworm; dsa · etcd · debian · 12

  • [etcd-server]Inconnu

    Paquet source: [etcd]

    Détails (2)

    • 3.4.23-4+b4 · amd64 · bookworm

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · bookworm; dsa · etcd · debian · 12

    • 3.4.23-4+b4 · arm64 · bookworm

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · bookworm; dsa · etcd · debian · 12

  • [golang-etcd-server-dev]Inconnu

    Paquet source: [etcd]

    Détails (2)

    • 3.4.23-4 · all · bookworm

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · bookworm; dsa · etcd · debian · 12

    • 3.4.23-4 · all · bookworm

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · bookworm; dsa · etcd · debian · 12

[Debian 13 (Trixie)]

  • [etcd-client]Inconnu

    Paquet source: [etcd]

    Détails (2)

    • 3.5.16-4 · amd64 · trixie

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · 13

    • 3.5.16-4 · arm64 · trixie

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · 13

  • [etcd-server]Inconnu

    Paquet source: [etcd]

    Détails (2)

    • 3.5.16-4 · amd64 · trixie

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · 13

    • 3.5.16-4 · arm64 · trixie

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · 13

  • [golang-etcd-server-dev]Inconnu

    Paquet source: [etcd]

    Détails (2)

    • 3.5.16-4 · all · trixie

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · 13

    • 3.5.16-4 · all · trixie

      Corrigée · Corrigée: 3.3.25+dfsg-5

      dsa · etcd · debian · 13

Observé:

Références

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]