Improper Preservation of Permissions in etcd

Vulnerability type

Access Controls

Detail

etcd creates certain directory paths (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already.

Specific Go Package Affected

github.com/etcd-io/etcd/pkg/fileutil

Workarounds

Make sure these directories have the desired permit (700).

References

Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)

For more information

If you have any questions or comments about this advisory:

• Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)