[<prev] [next>] [day] [month] [year] [list]
Message-Id: <FC2E54FA-15CB-4732-9E1B-FB35F7A01EEB@apache.org>
Date: Tue, 19 May 2020 16:05:37 +0200
From: Jan Lehnardt <jan@...che.org>
To: oss-security@...ts.openwall.com
Subject: [CVE-2020-1955] Apache CouchDB Remote Privilege Escalation
Description
===========
CouchDB version 3.0.0 shipped with a new configuration setting that
governs access control to the entire database server called
`require_valid_user_except_for_up`. It was meant as an extension to the
long-standing setting `require_valid_user`, which in turn requires that
any and all requests to CouchDB will have to be made with valid
credentials, effectively forbidding any anonymous requests.
The new `require_valid_user_except_for_up` is an off-by-default setting
that was meant to allow requiring valid credentials for all endpoints
except for the `/_up` endpoint.
However, the implementation of this made an error that lead to not
enforcing credentials on any endpoint, when enabled.
CouchDB versions 3.0.1[1] and 3.1.0[2] fix this issue.
Mitigation
==========
Users who have not enabled `require_valid_user_except_for_up` are not
affected.
Users who have it enabled can either disable it again, or upgrade to
CouchDB versions 3.0.1[1] and 3.1.0[2].
[1]: https://docs.couchdb.org/en/stable/whatsnew/3.0.html#version-3-0-1
[2]: https://docs.couchdb.org/en/stable/whatsnew/3.1.html#version-3-1-0
On behalf of the CouchDB Security team,
Jan LehnardT
—
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
