Esta página enumera alertas y avisos críticos para Couchbase.
Manténgase informado sobre las últimas alertas críticas y avisos para Couchbase Server suscribiéndose a nuestras notificaciones de actualización. Para suscribirse, regístrese en nuestro sitio de soporte y siga este artículo: Announcements – Couchbase Support
Enterprise Security Alerts
-
Credentials are negotiated with KV using SCRAM-SHA when remote link encryption is configured for HALF
SDK will negotiate with SCRAM-SHA by default which allows for a MITM to negotiate for PLAIN credentials
-
Upgrade to OpenSSL 3.1.4
Applications that use the functions DH_generate_key() to generate an X9.42 DH key and applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.
-
Upgrade cURL to 8.4.0
The flaw in curl makes it overflow a heap based buffer in the SOCKS5 proxy handshake.
-
TLS Private key leaked in XDCR log file
The private key used for Cross Datacenter Replication (XDCR) was leaked in the goxdcr.log
-
The internal Full Admin user for cluster management credentials leaked to log file
A logging event caused the internal @ns_server admin credentials to be leaked in encoded form in diag.log.
-
Eventing SQL++ cURL calls to /diag/eval were not sufficiently restricted
Calling cURL via SQL++ (N1QL) via the Eventing Service to the local host’s /diag/eval endpoint wasn’t fully prevented.