VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 5, 2020· Updated Aug 4, 2024

Improper Preservation of Permissions in etcd

CVE-2020-15113

Description

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/etcd-io/etcdGo
>= 3.4.0-rc.0, < 3.4.103.4.10
github.com/etcd-io/etcdGo
< 3.3.233.3.23

Affected products

1

Patches

2
e5424fc474b2

pkg: Fix dir permission check on Windows

https://github.com/etcd-io/etcdChangxin MiaoMay 25, 2020via ghsa
commit
3 files changed · +10 −2
  • pkg/fileutil/dir_unix.go+5 −0 modified
    @@ -18,5 +18,10 @@ package fileutil
 
 import "os"
 
+const (
+	// PrivateDirMode grants owner to make/remove files inside the directory.
+	PrivateDirMode = 0700
+)
+
 // OpenDir opens a directory for syncing.
 func OpenDir(path string) (*os.File, error) { return os.Open(path) }
  • pkg/fileutil/dir_windows.go+5 −0 modified
    @@ -21,6 +21,11 @@ import (
 	"syscall"
 )
 
+const (
+	// PrivateDirMode grants owner to make/remove files inside the directory.
+	PrivateDirMode = 0777
+)
+
 // OpenDir opens a directory in windows with write access for syncing.
 func OpenDir(path string) (*os.File, error) {
 	fd, err := openDir(path)
  • pkg/fileutil/fileutil.go+0 −2 modified
    @@ -27,8 +27,6 @@ import (
 const (
 	// PrivateFileMode grants owner to read/write a file.
 	PrivateFileMode = 0600
-	// PrivateDirMode grants owner to make/remove files inside the directory.
-	PrivateDirMode = 0700
 )
 
 var plog = capnslog.NewPackageLogger("go.etcd.io/etcd", "pkg/fileutil")
6be5c54c9429

pkg: Fix dir permission check on Windows

https://github.com/etcd-io/etcdChangxin MiaoMay 25, 2020via ghsa
commit
3 files changed · +10 −2
  • pkg/fileutil/dir_unix.go+5 −0 modified
    @@ -18,5 +18,10 @@ package fileutil
 
 import "os"
 
+const (
+	// PrivateDirMode grants owner to make/remove files inside the directory.
+	PrivateDirMode = 0700
+)
+
 // OpenDir opens a directory for syncing.
 func OpenDir(path string) (*os.File, error) { return os.Open(path) }
  • pkg/fileutil/dir_windows.go+5 −0 modified
    @@ -21,6 +21,11 @@ import (
 	"syscall"
 )
 
+const (
+	// PrivateDirMode grants owner to make/remove files inside the directory.
+	PrivateDirMode = 0777
+)
+
 // OpenDir opens a directory in windows with write access for syncing.
 func OpenDir(path string) (*os.File, error) {
 	fd, err := openDir(path)
  • pkg/fileutil/fileutil.go+0 −2 modified
    @@ -29,8 +29,6 @@ import (
 const (
 	// PrivateFileMode grants owner to read/write a file.
 	PrivateFileMode = 0600
-	// PrivateDirMode grants owner to make/remove files inside the directory.
-	PrivateDirMode = 0700
 )
 
 var (

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.