PT-2019-12327 · Couchbase · Couchbase Server

Publicado 2019-09-10 · Atualizado 2020-08-24 · CVE-2019-11467

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 4.6.3 through 5.5.0

Description The issue arises when secondary indexing in Couchbase Server encodes entries to be indexed using collatejson. If index entries contain specific characters like t, <, or >, it causes a buffer overrun because the encoded string becomes larger than expected, leading to the indexer service crashing and restarting.

Recommendations For Couchbase Server versions 4.6.3 through 5.1.1, update to version 5.1.2 to ensure the buffer always grows as needed for any input. For Couchbase Server version 5.5.0, update to version 5.5.2 to resolve the issue. For Couchbase Server versions prior to 5.1.2 and 5.5.2, consider restricting the use of characters that may cause buffer overruns in index entries until the issue is resolved.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2019-11467

Produtos afetados

Couchbase Server

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-11467 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11467 · Nota de Segurança
• https://couchbase.com/resources/security#SecurityAlerts · Aviso do Fabricante