PT-2024-5971 · Couchbase · Couchbase Server

Published 2024-05-31 · Updated 2024-09-19 · CVE-2024-37034

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 7.2.5 Couchbase Server versions 7.6.0 through 7.6.0

Description The issue is related to insufficient encryption of data in the Key-Value (KV) service of Couchbase Server. This could allow a remote attacker to disclose protected information when remote link encryption is configured for Half-Secure. The problem arises because the system does not ensure that credentials are negotiated with the KV service using SCRAM-SHA under these conditions.

Recommendations For versions prior to 7.2.5, update to version 7.2.5 or later. For versions 7.6.0, update to version 7.6.1 or later. As a temporary workaround, consider configuring remote link encryption to use Full-Secure mode until a patch is available.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BDU:2024-06779

CVE-2024-37034

Affected Products

Couchbase Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-37034 · Security Note
• https://couchbase.com/alerts · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37034 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06779 · Security Note
• https://t.me/cvedetector/1732 · Telegram Post
• https://t.me/cvenotify/87629 · Telegram Post
• https://vuldb.com/?id.272540 · Note
• https://t.me/cvenotify/95253 · Telegram Post