In questa pagina sono elencati gli avvisi e i consigli critici per Couchbase.
Rimanete informati sugli ultimi avvisi e avvisi critici per Couchbase Server iscrivendovi alle nostre notifiche di aggiornamento. Per iscriversi, registrarsi sul nostro sito di supporto e seguire questo articolo: Annunci – Supporto Couchbase
Avvisi di Sicurezza Aziendale
-
Credentials are negotiated with KV using SCRAM-SHA when remote link encryption is configured for HALF
SDK will negotiate with SCRAM-SHA by default which allows for a MITM to negotiate for PLAIN credentials
-
Upgrade to OpenSSL 3.1.4
Applications that use the functions DH_generate_key() to generate an X9.42 DH key and applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.
-
Upgrade cURL to 8.4.0
The flaw in curl makes it overflow a heap based buffer in the SOCKS5 proxy handshake.
-
TLS Private key leaked in XDCR log file
The private key used for Cross Datacenter Replication (XDCR) was leaked in the goxdcr.log
-
The internal Full Admin user for cluster management credentials leaked to log file
A logging event caused the internal @ns_server admin credentials to be leaked in encoded form in diag.log.
-
Eventing SQL++ cURL calls to /diag/eval were not sufficiently restricted
Calling cURL via SQL++ (N1QL) via the Eventing Service to the local host’s /diag/eval endpoint wasn’t fully prevented.