In questa pagina sono elencati gli avvisi e i consigli critici per Couchbase.
Rimanete informati sugli ultimi avvisi e avvisi critici per Couchbase Server iscrivendovi alle nostre notifiche di aggiornamento. Per iscriversi, registrarsi sul nostro sito di supporto e seguire questo articolo: Annunci – Supporto Couchbase
Avvisi di Sicurezza Aziendale
-
Query Service stats endpoint was accessible without authentication
The Query stats endpoint did not implement correct authentication, making it possible to view the stats information
-
Private key leak in debug.log while adding pre-7.0 node to 7.2 cluster
The private key is leaked to debug.log when adding a pre-7.0 node to 7.2 cluster.
-
Unauthenticated users may cause memcached to run out of memory
A malicious user may easily crash a memcached server by connecting to the server and start sending large commands.
-
Windows traversal security issue
The Couchbase Server Windows UI allows an attacker to traverse the filesystem and display files that Couchbase has access to. This vulnerability doesn’t require any authentication. It’s exploitable with just appending folders/files to the Couchbase Server admin UI’s URL.
-
Update OpenJDK to 11.0.19
Update OpenJDK to versions 11.0.19 to resolve numerous CVEs.
-
Update V8 to 11.4.185.1
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.