이 페이지에는 Couchbase에 대한 중요 알림 및 권고가 나열되어 있습니다.
업데이트 알림을 구독하여 Couchbase Server에 대한 최신 중요 경고 및 권고에 대한 정보를 받아보세요. 가입하려면 지원 사이트에서 등록하고 이 문서를 따르세요: 공지사항 – Couchbase 지원
기업 보안 경고
-
A specially crafted network packet sent from an attacker can crash memcached
This can cause unavailability of the Data Service. It is recommended to use a firewall to only allow network traffic from your applications to communicate with the Couchbase Server cluster.
-
A specially crafted network packet sent from an attacker can crash memcached
This can cause unavailability of the Data Service. It is recommended to use a firewall to only allow network traffic from your applications to communicate with the Couchbase Server cluster.
-
Update of AngularJS to 1.8.0
Issue in Angular as used by the Couchbase UI that can cause a denial of service by modifying the merge() function.
-
Update of OpenSSL to version 1.1.1k
Multiple security issues resolved in OpenSSL, one of which could cause the TLS server to crash if sent a maliciously crafted renegotiation ClientHello message from a client.
-
Externally managed users are not prevented from using an empty password, per RFC4513
If an LDAP or Active Directory server, used for external authentication, is configured to allow insecure unauthenticated binds, the Couchbase Server Cluster Manager will allow an external user to be authenticated with an empty password. LDAP servers can be configured to fail Unauthenticated Bind requests with a resultCode of “unwillingToPerform” to prevent this occurring.
-
Index Service is leaking internal administrative credentials into the logging.
Internal rest calls (/listCreateTokens, /listRebalanceTokens, /listMetadataTokens) are getting logged into the indexer.log with unredacted Base64 encoded authentication information for internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth.