This page lists critical alerts and advisories for Couchbase.
Stay informed about the latest critical alerts and advisories for Couchbase Server by subscribing to our update notifications. To sign up, please register on our support site and follow this article: Announcements – Couchbase Support
Enterprise Security Alerts
-
Authentication information is leaked when invalid REST requests are received.
When the Couchbase Server REST endpoint receives an unknown request, the request is logged as an error in the debug.log and info.log. The log includes unredacted Base64-encoded authentication information. The error message also is shown in the logs tab of the UI.
-
Update of the urllib3 library used by the Couchbase CLI to version 1.26.3
The Python urllib3 library which is used by the requests Python library that in turn is used by the Couchbase CLI has a security issue in urllib3 versions before 1.24.2. The library mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome.
-
Update Apache HttpClient library used by Analytics Service to version 4.5.13
The Apache HttpClient, as used by the Couchbase Server Analytics Service, in versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
-
Update of the buger/jsonparser library used by the Search Service to version 1.1.1
A security issue in the buger/jsonparser (JSON parser for Go) library allows an attacker to cause a denial of service (DOS) in the Couchbase Server Search Service.
-
An unredacted session cookie was included in audit logs and debug.log for audited actions where a session ID was included
Couchbase Server was logging the temporary session cookie for a user when audited events containing a session ID were logged to the audit log and debug.log. An attacker with access to logging data could use this to impersonate an authenticated user.
-
View Engine auditing condition leaks authentication information into the logs
A rare condition that is triggered when Auditing is enabled for the View Engine and Node to Node encryption is enabled. If Couchbase Server is unable to check the remote hostname and port of an incoming internal command (view-merge request) over TLS, an error is logged which contains unredacted Base64 encoded authentication information for an internal user with administrator privileges, @ns_server. A temporary workaround is to disable View Engine auditing or Node to Node Encryption until an upgrade can be performed.