This page lists critical alerts and advisories for Couchbase.
Stay informed about the latest critical alerts and advisories for Couchbase Server by subscribing to our update notifications. To sign up, please register on our support site and follow this article: Announcements – Couchbase Support
Enterprise Security Alerts
-
Credentials are negotiated with KV using SCRAM-SHA when remote link encryption is configured for HALF
SDK will negotiate with SCRAM-SHA by default which allows for a MITM to negotiate for PLAIN credentials
-
Upgrade to OpenSSL 3.1.4
Applications that use the functions DH_generate_key() to generate an X9.42 DH key and applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.
-
Upgrade cURL to 8.4.0
The flaw in curl makes it overflow a heap based buffer in the SOCKS5 proxy handshake.
-
TLS Private key leaked in XDCR log file
The private key used for Cross Datacenter Replication (XDCR) was leaked in the goxdcr.log
-
The internal Full Admin user for cluster management credentials leaked to log file
A logging event caused the internal @ns_server admin credentials to be leaked in encoded form in diag.log.
-
Eventing SQL++ cURL calls to /diag/eval were not sufficiently restricted
Calling cURL via SQL++ (N1QL) via the Eventing Service to the local host’s /diag/eval endpoint wasn’t fully prevented.