This page lists critical alerts and advisories for Couchbase.
Stay informed about the latest critical alerts and advisories for Couchbase Server by subscribing to our update notifications. To sign up, please register on our support site and follow this article: Announcements – Couchbase Support
Enterprise Security Alerts
-
Sample bucket loading may leak internal user passwords during a failure
A failure while loading a sample bucket (beer-sample, gamesim-sample, travel-sample) may leak the password for the internal @ns_server admin user into the logs (debug.log, error.log, info.log, reports.log). The @ns_server account can be used to perform administrative actions.
-
Python updated to 3.9.12 to address a denial of service issue
A flaw was found in Python. An improperly handled HTTP response in the HTTP client code of Python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. This issue only affects clusters using the developer preview feature, Analytics UDFs.
-
Couchbase Server leaks the Cluster Manager cookie
In affected versions of Couchbase Server, the Erlang “cookie” is passed via a command-line argument to ‘erl’ when using the ‘server-eshell’ command; this leaked the “cookie” to all who could read the ‘couchbase-cli’ process arguments. The cookie should remain secret as it can be used to perform administrative tasks in the cluster.
-
XDCR – lacks role checking when changing internal settings
In affected versions of Couchbase Server, XDCR internal settings can be modified without any authentication.
-
Operations may succeed on collection using stale RBAC permission
If an RBAC role contains a collection-level permission (e.g., query_select[src:_default:Collection1]) and the collection name is deleted and re-created in the bucket, the collection-level permission will still be valid. This allows the user with the role to access the collection even though their permission should have been removed when the collection was deleted.
-
couchbase-cli leaks Secrets Management master password as a command-line argument
The couchbase-cli spawns a very short-lived erlang process that has the master password as a process argument, this means that if anyone gets the process list at that time they will have the master password. This only affects Couchbase Server clusters utilizing the Secrets Management feature.