このページでは、Couchbaseの重要なアラートとアドバイザリを一覧表示します。
更新通知を購読することで、Couchbase Serverの最新の重要なアラートとアドバイザリに関する情報を入手できます。登録するには、当社のサポートサイトに登録し、この記事に従ってください： お知らせ – Couchbase サポート
エンタープライズセキュリティアラート
-
SQL++ N1QL cURL host restrictions implementation issue
The SQL++ (N1QL) cURL allowlist protection in the Query Service, wasn’t sufficient in preventing accessing restricted hosts.
-
SQL++ cURL calls to /diag/eval were not sufficiently restricted
Calling cURL via SQL++ (N1QL) using the Query Service to the localhost’s /diag/eval endpoint wasn’t fully prevented.
-
otpCookie was shown to a user with a Full Admin role on the Cluster Manager’s API endpoints serverGroups and engageCluster2
The cluster’s otpCookie was leaked to users with Full Admin role on API endpoint serverGroups and both Cluster Admin and Full Admin on API endpoint engageCluster2. This could be used to elevate privileges
-
Unauthenticated RMI Service Ports Exposed in Analytics Service
Network ports 9119 and 9121 were unauthenticated RMI service ports hosted by the Analytics Service which could result in privilege escalation.
-
Data readers could DOS the reader threads
A user with Data Reader role could lock a Data Service reader thread for a significant time by requesting a high number of keys and potentially lock up all reader threads by issuing the same command on multiple connections
-
User with Data Reader role could OOM kill the Data Service
A user with the Data Reader privilege could kill the Data Service by sending GetKeys requesting a high number of documents, triggering a Out-of-Memory (OOM) error.