このページでは、Couchbaseの重要なアラートとアドバイザリを一覧表示します。
更新通知を購読することで、Couchbase Serverの最新の重要なアラートとアドバイザリに関する情報を入手できます。登録するには、当社のサポートサイトに登録し、この記事に従ってください： Announcements – Couchbase Support
Enterprise Security Alerts
-
Credentials are negotiated with KV using SCRAM-SHA when remote link encryption is configured for HALF
SDK will negotiate with SCRAM-SHA by default which allows for a MITM to negotiate for PLAIN credentials
-
Upgrade to OpenSSL 3.1.4
Applications that use the functions DH_generate_key() to generate an X9.42 DH key and applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.
-
Upgrade cURL to 8.4.0
The flaw in curl makes it overflow a heap based buffer in the SOCKS5 proxy handshake.
-
TLS Private key leaked in XDCR log file
The private key used for Cross Datacenter Replication (XDCR) was leaked in the goxdcr.log
-
The internal Full Admin user for cluster management credentials leaked to log file
A logging event caused the internal @ns_server admin credentials to be leaked in encoded form in diag.log.
-
Eventing SQL++ cURL calls to /diag/eval were not sufficiently restricted
Calling cURL via SQL++ (N1QL) via the Eventing Service to the local host’s /diag/eval endpoint wasn’t fully prevented.