PT-2020-20453 · Couchbase+1 · Couchbase Server Java Sdk+1

Published 2020-06-08 · Updated 2020-06-11 · CVE-2020-9040

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Couchbase Server Java SDK versions prior to 2.7.1.1

Description The issue allows a potential attacker to forge an SSL certificate and pose as the intended peer. This can be achieved by crafting a cryptographically valid certificate that will be accepted due to missing hostname verification in the Java SDK's Netty component.

Recommendations For versions prior to 2.7.1.1, update to version 2.7.1.1 or later to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-9040

Affected Products

Couchbase Server Java Sdk

Netty

References · 3

• https://osv.dev/vulnerability/CVE-2020-9040 · Vendor Advisory
• https://couchbase.com/resources/security#SecurityAlerts · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9040 · Security Note