카우치베이스 알림

When the Couchbase Server REST endpoint receives an unknown request, the request is logged as an error in the debug.log and info.log. The log includes unredacted Base64-encoded authentication information. The error message also is shown in the logs tab of the UI.

The Python urllib3 library which is used by the requests Python library that in turn is used by the Couchbase CLI has a security issue in urllib3 versions before 1.24.2. The library mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome.

The Apache HttpClient, as used by the Couchbase Server Analytics Service, in versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

A security issue in the buger/jsonparser (JSON parser for Go) library allows an attacker to cause a denial of service (DOS) in the Couchbase Server Search Service.

Couchbase Server was logging the temporary session cookie for a user when audited events containing a session ID were logged to the audit log and debug.log. An attacker with access to logging data could use this to impersonate an authenticated user.

A rare condition that is triggered when Auditing is enabled for the View Engine and Node to Node encryption is enabled. If Couchbase Server is unable to check the remote hostname and port of an incoming internal command (view-merge request) over TLS, an error is logged which contains unredacted Base64 encoded authentication information for an internal user with administrator privileges, @ns_server. A temporary workaround is to disable View Engine auditing or Node to Node Encryption until an upgrade can be performed.