Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 9 May 2022 12:54:56 +0400
From: Archange <>
To:, Jan Lehnardt <>
Subject: Re: CVE-2022-24706: Apache CouchDB: Remote Code
 Execution Vulnerability in Packaging


Le 26/04/2022 à 12:44, Jan Lehnardt a écrit :
> […]
> In addition, all binary packages have been updated to bind `epmd` as
> well as the CouchDB distribution port to `` and/or `::1`
> respectively.
> Credit:
> The Apache CouchDB Team would like to thank Alex Vandiver <> for the report of this issue.
> References:

Regarding epmd, how is this achieved in the binary packages? Because on 
Arch at least, setting `ERL_EPMD_ADDRESS=` as stated in is 
still required. Should Arch make that a default in the systemd service 
file? For now this has just been a recommandation for single node 
security since 2017 
but I can make it the default (the second part of the wiki advice being 
now an upstream default, I think it would make some sense).

Bruno/Archange (Arch maintainer for CouchDB)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.