이 페이지에는 Couchbase에 대한 중요 알림 및 권고가 나열되어 있습니다.
업데이트 알림을 구독하여 Couchbase Server에 대한 최신 중요 경고 및 권고에 대한 정보를 받아보세요. 가입하려면 지원 사이트에서 등록하고 이 문서를 따르세요: Announcements – Couchbase Support
Enterprise Security Alerts
-
SQL++ N1QL cURL host restrictions implementation issue
The SQL++ (N1QL) cURL allowlist protection in the Query Service, wasn’t sufficient in preventing accessing restricted hosts.
-
SQL++ cURL calls to /diag/eval were not sufficiently restricted
Calling cURL via SQL++ (N1QL) using the Query Service to the localhost’s /diag/eval endpoint wasn’t fully prevented.
-
otpCookie was shown to a user with a Full Admin role on the Cluster Manager’s API endpoints serverGroups and engageCluster2
The cluster’s otpCookie was leaked to users with Full Admin role on API endpoint serverGroups and both Cluster Admin and Full Admin on API endpoint engageCluster2. This could be used to elevate privileges
-
Unauthenticated RMI Service Ports Exposed in Analytics Service
Network ports 9119 and 9121 were unauthenticated RMI service ports hosted by the Analytics Service which could result in privilege escalation.
-
Data readers could DOS the reader threads
A user with Data Reader role could lock a Data Service reader thread for a significant time by requesting a high number of keys and potentially lock up all reader threads by issuing the same command on multiple connections
-
User with Data Reader role could OOM kill the Data Service
A user with the Data Reader privilege could kill the Data Service by sending GetKeys requesting a high number of documents, triggering a Out-of-Memory (OOM) error.