PT-2019-12327 · Couchbase · Couchbase Server

Published 2019-09-10 · Updated 2020-08-24 · CVE-2019-11467

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 4.6.3 through 5.5.0

Description The issue arises when secondary indexing in Couchbase Server encodes entries to be indexed using collatejson. If index entries contain specific characters like t, <, or >, it causes a buffer overrun because the encoded string becomes larger than expected, leading to the indexer service crashing and restarting.

Recommendations For Couchbase Server versions 4.6.3 through 5.1.1, update to version 5.1.2 to ensure the buffer always grows as needed for any input. For Couchbase Server version 5.5.0, update to version 5.5.2 to resolve the issue. For Couchbase Server versions prior to 5.1.2 and 5.5.2, consider restricting the use of characters that may cause buffer overruns in index entries until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2019-11467

Affected Products

Couchbase Server

References · 3

• https://osv.dev/vulnerability/CVE-2019-11467 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11467 · Security Note
• https://couchbase.com/resources/security#SecurityAlerts · Vendor Advisory