Esta página enumera alertas y avisos críticos para Couchbase.
Manténgase informado sobre las últimas alertas críticas y avisos para Couchbase Server suscribiéndose a nuestras notificaciones de actualización. Para suscribirse, regístrese en nuestro sitio de soporte y siga este artículo: Anuncios – Soporte de Couchbase
Alertas de Seguridad Empresarial
-
Update of Apache Parquet to 1.12.3
An attacker can use Parquet files, as optionally used by the Couchbase Analytics Service, to cause a Denial of Service (DoS) if malicious files contain improper values in the file page header (e.g. negative values where positive value is expected). This is resolved by updating the Apache Parquet library to a later version.
-
Update of js-beautify to 1.14.3, a client-side javascript library used in the Couchbase Server UI
js-beautify has a dependency with a known vulnerability, Minimist. Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). Prototype pollution attacks allow bypassing input validation and triggering unexpected javascript execution.
-
Updating ramda, a client-side javascript library to version 0.28 as used in the Couchbase Server UI
Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property “{}proto{}”) as an argument to the function, known as prototype pollution. Prototype pollution type attacks allow bypassing input validation and triggering unexpected javascript execution.
-
Encrypted Private Key passphrase may be leaked in the logs
In Couchbase Server 7.1.0 and later it’s possible to provide a passphrase to Couchbase Server to unlock an encrypted TLS private key. This passphrase was found to be leaked in the log files as a Base64 encoded string when one of the Couchbase services, other than the Data Service, was starting up. This affects the Index Service, Query Service, Analytics Service, Backup Service and Eventing Service if the optional encrypted TLS keys feature is used. Note, an attacker needs to have access to the logs as well as the private key to be able to perform attacks such as performing a man in the middle attack or decrypting network communication. Using operating system protections to restrict access to these files can be an effective mitigation strategy.
-
Update of jackson-databind library to version 2.13.2.2
jackson-databind, before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. This library is used by the Couchbase Server Analytics Service.
-
Update of GoLang to a minimum of 1.17.9 or 1.18.1
Updated Go Programming Language and associated libraries used in multiple Couchbase Server services to versions 1.17.9+ or 1.18.1+ to resolve numerous CVEs.