Cette page répertorie les alertes et avis critiques pour Couchbase.
Restez informé des dernières alertes et avis critiques pour Couchbase Server en vous abonnant à nos notifications de mise à jour. Pour vous inscrire, veuillez vous enregistrer sur notre site de support et suivre cet article : Announcements – Couchbase Support
Enterprise Security Alerts
-
SQL++ N1QL cURL host restrictions implementation issue
The SQL++ (N1QL) cURL allowlist protection in the Query Service, wasn’t sufficient in preventing accessing restricted hosts.
-
SQL++ cURL calls to /diag/eval were not sufficiently restricted
Calling cURL via SQL++ (N1QL) using the Query Service to the localhost’s /diag/eval endpoint wasn’t fully prevented.
-
otpCookie was shown to a user with a Full Admin role on the Cluster Manager’s API endpoints serverGroups and engageCluster2
The cluster’s otpCookie was leaked to users with Full Admin role on API endpoint serverGroups and both Cluster Admin and Full Admin on API endpoint engageCluster2. This could be used to elevate privileges
-
Unauthenticated RMI Service Ports Exposed in Analytics Service
Network ports 9119 and 9121 were unauthenticated RMI service ports hosted by the Analytics Service which could result in privilege escalation.
-
Data readers could DOS the reader threads
A user with Data Reader role could lock a Data Service reader thread for a significant time by requesting a high number of keys and potentially lock up all reader threads by issuing the same command on multiple connections
-
User with Data Reader role could OOM kill the Data Service
A user with the Data Reader privilege could kill the Data Service by sending GetKeys requesting a high number of documents, triggering a Out-of-Memory (OOM) error.