이 페이지에는 Couchbase에 대한 중요 알림 및 권고가 나열되어 있습니다.
업데이트 알림을 구독하여 Couchbase Server에 대한 최신 중요 경고 및 권고에 대한 정보를 받아보세요. 가입하려면 지원 사이트에서 등록하고 이 문서를 따르세요: 공지사항 – Couchbase 지원
기업 보안 경고
-
Update of GoLang to 1.19.9
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
-
Upgrade to OpenSSL 1.1.1u
A vulnerability in OpenSSL related to the verification of X.509 certificate chains that include policy constraints., which would allow attackers to be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems.
-
Upgrade Golang to 1.20.10
The HTTP/2 protocol allows a denial of service because request cancellation can reset many streams quickly.
-
Upgrade gRPC to v1.58.3
The HTTP/2 protocol allows a denial of service because request cancellation can reset many streams quickly.
-
Update Netty to 4.1.86.Final or higher
In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion.
-
Full Text Search (FTS) nsstats endpoint is accessible without authentication
The FTS stats endpoint at /api/nsstats does not implement correct authentication, so it is possible to view the names of Couchbase Server buckets, the names of FTS indexes and configuration of FTS indexes without authentication. The contents of the buckets and indexes are not exposed.