PT-2023-20577 · Apache · Apache Couchdb

Nick Vatamaniuc · Published 2023-05-02 · Updated 2024-03-06 · CVE-2023-26268

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CouchDB versions prior to 3.2.3 Apache CouchDB versions prior to 3.3.2

Description Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:

• validate doc update
• list
• filter
• filter views (using view functions as filters)
• rewrite
• update This doesn't affect map/reduce or search (Dreyfus) index functions.

Recommendations For versions prior to 3.2.3, upgrade to Apache CouchDB 3.2.3 or later. For versions prior to 3.3.2, upgrade to Apache CouchDB 3.3.2 or later. As a temporary workaround, consider avoiding the use of design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-COUCHDB-2023-26268

CVE-2023-26268

Affected Products

Apache Couchdb

References · 11

• https://lists.apache.org/thread/ldkqs0nhpmho26bdxf4fon7w75hsq5gl · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26268 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26268 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26268 · Vendor Advisory
• https://docs.couchdb.org/en/stable/cve/2023-26268.html · Vendor Advisory
• https://lists.apache.org/thread/r2wvjfysg3d92lhhjd1qh3wfr8mlp0pp · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26268 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-26268 · Security Note
• https://osv.dev/vulnerability/BIT-couchdb-2023-26268 · Vendor Advisory
• https://t.me/cibsecurity/63183 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26268 · Note