PT-2024-13136 · Couchbase · Couchbase Server

Published 2024-03-26 · Updated 2024-08-05 · CVE-2023-43768

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 6.6.x through 7.2.0

Description An issue was discovered in Couchbase Server where unauthenticated users may cause memcached to run out of memory via large commands.

Recommendations For Couchbase Server versions 6.6.x through 7.1.4, update to version 7.1.5 or later. For Couchbase Server versions 7.2.0, update to version 7.2.1 or later. As a temporary workaround, consider restricting access to memcached to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2023-43768

Affected Products

Couchbase Server

References · 10

• https://osv.dev/vulnerability/CVE-2023-43768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43768 · Security Note
• https://couchbase.com/alerts · Vendor Advisory
• https://t.me/cvenotify/74804 · Telegram Post
• https://forums.couchbase.com/tags/security · Note
• https://twitter.com/CVEnew/status/1772879311969686014 · Twitter Post
• https://couchbase.com/downloads · Note
• https://docs.couchbase.com/server/current/release-notes/relnotes.html · Note
• https://t.me/cvenotify/89210 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1772937698543612228 · Twitter Post