PT-2023-20577 · Apache · Apache Couchdb

Nick Vatamaniuc · Publicado 2023-05-02 · Atualizado 2024-03-06 · CVE-2023-26268

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CouchDB versions prior to 3.2.3 Apache CouchDB versions prior to 3.3.2

Description Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:

• validate doc update
• list
• filter
• filter views (using view functions as filters)
• rewrite
• update This doesn't affect map/reduce or search (Dreyfus) index functions.

Recommendations For versions prior to 3.2.3, upgrade to Apache CouchDB 3.2.3 or later. For versions prior to 3.3.2, upgrade to Apache CouchDB 3.3.2 or later. As a temporary workaround, consider avoiding the use of design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BIT-COUCHDB-2023-26268

CVE-2023-26268

Produtos afetados

Apache Couchdb

Referências · 11

• https://lists.apache.org/thread/ldkqs0nhpmho26bdxf4fon7w75hsq5gl · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26268 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-26268 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26268 · Aviso do Fabricante
• https://docs.couchdb.org/en/stable/cve/2023-26268.html · Aviso do Fabricante
• https://t.me/cibsecurity/63183 · Publicação no Telegram
• https://lists.apache.org/thread/r2wvjfysg3d92lhhjd1qh3wfr8mlp0pp · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-26268 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-26268 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26268 · Nota
• https://osv.dev/vulnerability/BIT-couchdb-2023-26268 · Aviso do Fabricante