이 페이지에는 Couchbase에 대한 중요 알림 및 권고가 나열되어 있습니다.
업데이트 알림을 구독하여 Couchbase Server에 대한 최신 중요 경고 및 권고에 대한 정보를 받아보세요. 가입하려면 지원 사이트에서 등록하고 이 문서를 따르세요: Announcements – Couchbase Support
Enterprise Security Alerts
-
Credentials are negotiated with KV using SCRAM-SHA when remote link encryption is configured for HALF
SDK will negotiate with SCRAM-SHA by default which allows for a MITM to negotiate for PLAIN credentials
-
Upgrade to OpenSSL 3.1.4
Applications that use the functions DH_generate_key() to generate an X9.42 DH key and applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.
-
Upgrade cURL to 8.4.0
The flaw in curl makes it overflow a heap based buffer in the SOCKS5 proxy handshake.
-
TLS Private key leaked in XDCR log file
The private key used for Cross Datacenter Replication (XDCR) was leaked in the goxdcr.log
-
The internal Full Admin user for cluster management credentials leaked to log file
A logging event caused the internal @ns_server admin credentials to be leaked in encoded form in diag.log.
-
Eventing SQL++ cURL calls to /diag/eval were not sufficiently restricted
Calling cURL via SQL++ (N1QL) via the Eventing Service to the local host’s /diag/eval endpoint wasn’t fully prevented.