This page lists critical alerts and advisories for Couchbase.
Stay informed about the latest critical alerts and advisories for Couchbase Server by subscribing to our update notifications. To sign up, please register on our support site and follow this article: Announcements – Couchbase Support
Enterprise Security Alerts
-
Up until core-io 1.7.11 (and as a result Java SDK 2.7.11), hostname verification on TLS/SSL connections is not enabled and can be a security risk in certain environments.
Java 6 (JDK 1.6 – the older SDK baseline version) did not support hostname verification out of the box. Once the SDK moved to Java 7 (Java 1.7) as the baseline, adding support was possible. This happened in jvm-core 1.7.11 (which translates to java-client 2.7.11). It is not possible in earlier versions to manually add it as a workaround, because the facilities to customize it accordingly are not exposed. Note that in order to not break applications that rely on the old behavior, hostname verification is still disabled by default, but can be enabled in the SDK configuration (CouchbaseEnvironment class).
-
Port 8092 misses X-XSS protection header.
Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however, some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and X-XSS-Protection, which are more generally applicable to HTML endpoints, to be included too. These headers are now included in responses from the Couchbase Server Views REST API (port 8092).
-
Prevent N1QL injection in Sync Gateway via _all_docs startkey, endkey.
An attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters “startkey” and “endkey” on the “_all_docs” endpoint. By issuing nested queries with CPU-intensive operations they may have been able to cause increased resource usage and denial of service conditions. The _all_docs endpoint is not required for Couchbase Mobile replication, and external access to this REST endpoint has been blocked to mitigate this issue. Recognition: Denis Werner/HiSolutions AG
-
Memcached “connections” stat block command emits non-redacted username.
The system information submitted to Couchbase as part of a bug report included the usernames for all users currently logged into the system even if the log was redacted for privacy. This has been fixed so that usernames are tagged properly in the logs and are hashed out when the logs are redacted.
-
Eventing debug endpoint must enforce authentication.
The eventing service exposes a system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied and now requires valid credentials to access.
-
The /diag/eval endpoint is not locked down to localhost.
Couchbase Server exposed the ‘/diag/eval’ endpoint, which, by default, is available on TCP/8091 and/or TCP/18091. Authenticated users that have ‘Full Admin‘ role assigned could send arbitrary Erlang code to the ‘diag/eval’ endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. Recognition: Apple Security Team