[GHSA-528j-9r78-wffx] etcd user credentials are stored in WAL logs in plaintext

[tdunlap607]

Updates

• References

Comments
Adding patch link: etcd-io/etcd@5858140

Adding original issue: etcd-io/etcd#10132

Adding PR: etcd-io/etcd#11818

A comment on May 24, 2020, in the issue (etcd-io/etcd#10132) regarding the plaintext password stored in WAL log entries: "I confirmed that 11818 removes the plaintext password of a WAL log entry of authenticate RPC (11818 (comment))."

[github]

Hi there @spzala! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our highly-trained Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[shelbyc]

@tdunlap607 Thank you for providing additional reference links!

[advisory-database]

Hi @tdunlap607! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!