Date: Tue, 19 May 2020 16:05:37 +0200 From: Jan Lehnardt <jan@...che.org> To: oss-security@...ts.openwall.com Subject: [CVE-2020-1955] Apache CouchDB Remote Privilege Escalation Description =========== CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up`. It was meant as an extension to the long-standing setting `require_valid_user`, which in turn requires that any and all requests to CouchDB will have to be made with valid credentials, effectively forbidding any anonymous requests. The new `require_valid_user_except_for_up` is an off-by-default setting that was meant to allow requiring valid credentials for all endpoints except for the `/_up` endpoint. However, the implementation of this made an error that lead to not enforcing credentials on any endpoint, when enabled. CouchDB versions 3.0.1 and 3.1.0 fix this issue. Mitigation ========== Users who have not enabled `require_valid_user_except_for_up` are not affected. Users who have it enabled can either disable it again, or upgrade to CouchDB versions 3.0.1 and 3.1.0. : https://docs.couchdb.org/en/stable/whatsnew/3.0.html#version-3-0-1 : https://docs.couchdb.org/en/stable/whatsnew/3.1.html#version-3-1-0 On behalf of the CouchDB Security team, Jan LehnardT —
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.