PT-2022-17780 · Couchbase · Couchbase Operator

Published 2022-03-07 · Updated 2022-03-18 · CVE-2022-26311

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Couchbase Operator versions 2.2.x through 2.2.2

Description The issue exposes sensitive information to unauthorized actors because secrets are not properly redacted in logs collected from Kubernetes environments.

Recommendations For Couchbase Operator versions 2.2.x through 2.2.2, update to version 2.2.3 or later to resolve the issue.

Fix

Related Identifiers

CVE-2022-26311

Affected Products

Couchbase Operator

References · 5

• https://couchbase.com/alerts · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26311 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26311 · Vendor Advisory
• https://docs.couchbase.com/operator/current/overview.html · Vendor Advisory
• https://t.me/cibsecurity/38690 · Telegram Post