Comments (10)
serathius
commented on August 27, 2024
2
That's an issue with bitnami, we don't support bitnami images.
from etcd.
ahrtr
commented on August 27, 2024
2
Our company is using etcd, but a vulnerability was found related to the ip:2379/debug/vars interface
Could you please help us to understand what vulnerability was found?
We may want add a flag --enable-debug (similar to --enable-pprof) to enable/disable this functionality, and defaults to false.
from etcd.
anjoy8
commented on August 27, 2024
How can we disable this feature in our etcd image?
Please help write a Docker command.
That's an issue with bitnami, we don't support bitnami images.
from etcd.
anjoy8
commented on August 27, 2024
Here is the translation:
I use the official image and wrote the following:
docker run -d \
-p 2379:2379 \
-p 2380:2380 \
--name etcd \
--volume $(pwd)/etcd-data:/etcd-data \
quay.io/coreos/etcd:v3.5.0 \
/usr/local/bin/etcd \
--name my-etcd-instance \
--data-dir /etcd-data \
--listen-client-urls http://0.0.0.0:2379 \
--advertise-client-urls http://0.0.0.0:2379 \
--listen-peer-urls http://0.0.0.0:2380However, when accessing /debug/vars, how can I disable this debug address?
from etcd.
serathius
commented on August 27, 2024
You can't, which is an interesting decision by previous maintainers.
from etcd.
serathius
commented on August 27, 2024
cc @ahrtr
from etcd.
serathius
commented on August 27, 2024
It's not vulnerability per se, but at least it's supprizing. Example of data in /debug/vars:
{
"cmdline": ["./bin/etcd","--enable-v2"],
"file_descriptor_limit": 131072,
"memstats": {"Alloc":4552976,"TotalAlloc":9683472,"Sys":19748104,"Lookups":0,"Mallocs":34144,"Frees":9823,"HeapAlloc":4552976,"HeapSys":11272192,"HeapIdle":4521984,"HeapInuse":6750208,"HeapReleased":2646016,"HeapObjects":24321,"StackInuse":1310720,"StackSys":1310720,"MSpanInuse":188800,"MSpanSys":195840,"MCacheInuse":28800,"MCacheSys":31200,"BuckHashSys":1452175,"GCSys":2898448,"OtherSys":2587529,"NextGC":7396016,"LastGC":1716815033051268308,"PauseTotalNs":405743,"PauseNs":[200767,45616,49613,109747,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"PauseEnd":[1716815033025284452,1716815033028402130,1716815033032624764,1716815033051268308,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"NumGC":4,"NumForcedGC":0,"GCCPUFraction":0.02077980265274588,"EnableGC":true,"DebugGC":false,"BySize":[{"Size":0,"Mallocs":0,"Frees":0},{"Size":8,"Mallocs":1143,"Frees":308},{"Size":16,"Mallocs":11743,"Frees":2918},{"Size":24,"Mallocs":2423,"Frees":946},{"Size":32,"Mallocs":1827,"Frees":590},{"Size":48,"Mallocs":6382,"Frees":441},{"Size":64,"Mallocs":2921,"Frees":249},{"Size":80,"Mallocs":394,"Frees":233},{"Size":96,"Mallocs":1687,"Frees":392},{"Size":112,"Mallocs":2428,"Frees":2087},{"Size":128,"Mallocs":148,"Frees":74},{"Size":144,"Mallocs":142,"Frees":52},{"Size":160,"Mallocs":230,"Frees":82},{"Size":176,"Mallocs":113,"Frees":5},{"Size":192,"Mallocs":68,"Frees":13},{"Size":208,"Mallocs":225,"Frees":101},{"Size":224,"Mallocs":64,"Frees":32},{"Size":240,"Mallocs":16,"Frees":0},{"Size":256,"Mallocs":42,"Frees":12},{"Size":288,"Mallocs":120,"Frees":45},{"Size":320,"Mallocs":63,"Frees":43},{"Size":352,"Mallocs":195,"Frees":10},{"Size":384,"Mallocs":10,"Frees":3},{"Size":416,"Mallocs":59,"Frees":24},{"Size":448,"Mallocs":167,"Frees":2},{"Size":480,"Mallocs":7,"Frees":3},{"Size":512,"Mallocs":32,"Frees":17},{"Size":576,"Mallocs":22,"Frees":12},{"Size":640,"Mallocs":14,"Frees":6},{"Size":704,"Mallocs":85,"Frees":55},{"Size":768,"Mallocs":12,"Frees":1},{"Size":896,"Mallocs":59,"Frees":26},{"Size":1024,"Mallocs":24,"Frees":6},{"Size":1152,"Mallocs":21,"Frees":6},{"Size":1280,"Mallocs":12,"Frees":2},{"Size":1408,"Mallocs":42,"Frees":26},{"Size":1536,"Mallocs":4,"Frees":1},{"Size":1792,"Mallocs":23,"Frees":10},{"Size":2048,"Mallocs":38,"Frees":6},{"Size":2304,"Mallocs":21,"Frees":8},{"Size":2688,"Mallocs":33,"Frees":31},{"Size":3072,"Mallocs":21,"Frees":6},{"Size":3200,"Mallocs":30,"Frees":12},{"Size":3456,"Mallocs":3,"Frees":0},{"Size":4096,"Mallocs":32,"Frees":17},{"Size":4864,"Mallocs":37,"Frees":32},{"Size":5376,"Mallocs":6,"Frees":2},{"Size":6144,"Mallocs":8,"Frees":2},{"Size":6528,"Mallocs":1,"Frees":1},{"Size":6784,"Mallocs":0,"Frees":0},{"Size":6912,"Mallocs":2,"Frees":2},{"Size":8192,"Mallocs":18,"Frees":1},{"Size":9472,"Mallocs":31,"Frees":5},{"Size":9728,"Mallocs":0,"Frees":0},{"Size":10240,"Mallocs":0,"Frees":0},{"Size":10880,"Mallocs":1,"Frees":0},{"Size":12288,"Mallocs":4,"Frees":4},{"Size":13568,"Mallocs":2,"Frees":2},{"Size":14336,"Mallocs":0,"Frees":0},{"Size":16384,"Mallocs":3,"Frees":0},{"Size":18432,"Mallocs":6,"Frees":2}]},
"raft.status": {"id":"8e9e05c52164694d","term":4,"vote":"8e9e05c52164694d","commit":8,"lead":"8e9e05c52164694d","raftState":"StateLeader","applied":8,"progress":{"8e9e05c52164694d":{"match":8,"next":9,"state":"StateReplicate"}},"leadtransferee":"0"}
}
Would be good to get some review from security about risks of exposing the data.
from etcd.
anjoy8
commented on August 27, 2024
It is a dedicated vulnerability check, and it discovered the address /debug/vars. This address is anonymous and returns configuration information, posing a risk of leakage.
from etcd.
anjoy8
commented on August 27, 2024
Can I encrypt this interface or add permissions when running Docker, so that users must log in to access it?
from etcd.
tjungblu
commented on August 27, 2024
You won't be able to do that from the container runtime. The only thing I could imagine would be a reverse proxy sidecar that explicitly disallows that path.
from etcd.
Related Issues (20)
- HashKV should compute the hash of all MVCC keys up to a given revision HOT 6
- Completion command is not included in releases of etcdctl HOT 1
- Etcd compilation process error HOT 4
- Etcd send a corrupt snapshot or missing hash snapshot to a snapshot api call which causes the restoration to fail. HOT 7
- option go_package in proto files HOT 4
- Client v3 and GRPC versions conflict HOT 3
- Member remains learner after promotion HOT 1
- Improvement of OpenSSF Scorecard Score HOT 4
- Enable `unexported-return` linter rule HOT 7
- High memory usage (memory leak?) with 1 node cluster and small DB (but a lot of updates) HOT 8
- The second node took about 7 seconds to join in a single node cluster HOT 9
- Add hashKV checking to robustness test HOT 8
- Introduce a Go workspace HOT 2
- Need to update golang pkg.dev document HOT 4
- support compile `tools` in makefile HOT 2
- Detected disallowed custom content in v2store
- Confusing documentation for `WatchResponse.canceled`
- etcd cluster crash
- Bump Go to 1.21.13/1.22.6 HOT 10
- etcd Go & Java client SDK's retry mechanism may break `Serializable` HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from etcd.