This page lists critical alerts and advisories for Couchbase.
Stay informed about the latest critical alerts and advisories for Couchbase Server by subscribing to our update notifications. To sign up, please register on our support site and follow this article: Announcements – Couchbase Support
Enterprise Security Alerts
-
A specially crafted network packet sent from an attacker can crash memcached
This can cause unavailability of the Data Service. It is recommended to use a firewall to only allow network traffic from your applications to communicate with the Couchbase Server cluster.
-
A specially crafted network packet sent from an attacker can crash memcached
This can cause unavailability of the Data Service. It is recommended to use a firewall to only allow network traffic from your applications to communicate with the Couchbase Server cluster.
-
Update of AngularJS to 1.8.0
Issue in Angular as used by the Couchbase UI that can cause a denial of service by modifying the merge() function.
-
Update of OpenSSL to version 1.1.1k
Multiple security issues resolved in OpenSSL, one of which could cause the TLS server to crash if sent a maliciously crafted renegotiation ClientHello message from a client.
-
Externally managed users are not prevented from using an empty password, per RFC4513
If an LDAP or Active Directory server, used for external authentication, is configured to allow insecure unauthenticated binds, the Couchbase Server Cluster Manager will allow an external user to be authenticated with an empty password. LDAP servers can be configured to fail Unauthenticated Bind requests with a resultCode of “unwillingToPerform” to prevent this occurring.
-
Index Service is leaking internal administrative credentials into the logging.
Internal rest calls (/listCreateTokens, /listRebalanceTokens, /listMetadataTokens) are getting logged into the indexer.log with unredacted Base64 encoded authentication information for internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth.