Alertas de Couchbase

A failure while loading a sample bucket (beer-sample, gamesim-sample, travel-sample) may leak the password for the internal @ns_server admin user into the logs (debug.log, error.log, info.log, reports.log). The @ns_server account can be used to perform administrative actions.

A flaw was found in Python. An improperly handled HTTP response in the HTTP client code of Python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. This issue only affects clusters using the developer preview feature, Analytics UDFs.

In affected versions of Couchbase Server, the Erlang “cookie” is passed via a command-line argument to ‘erl’ when using the ‘server-eshell’ command; this leaked the “cookie” to all who could read the ‘couchbase-cli’ process arguments. The cookie should remain secret as it can be used to perform administrative tasks in the cluster.

In affected versions of Couchbase Server, XDCR internal settings can be modified without any authentication.

If an RBAC role contains a collection-level permission (e.g., query_select[src:_default:Collection1]) and the collection name is deleted and re-created in the bucket, the collection-level permission will still be valid. This allows the user with the role to access the collection even though their permission should have been removed when the collection was deleted.

The couchbase-cli spawns a very short-lived erlang process that has the master password as a process argument, this means that if anyone gets the process list at that time they will have the master password. This only affects Couchbase Server clusters utilizing the Secrets Management feature.