Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 19 May 2020 16:05:37 +0200
From: Jan Lehnardt <>
Subject: [CVE-2020-1955] Apache CouchDB Remote Privilege Escalation


CouchDB version 3.0.0 shipped with a new configuration setting that
governs access control to the entire database server called
`require_valid_user_except_for_up`. It was meant as an extension to the
long-standing setting `require_valid_user`, which in turn requires that
any and all requests to CouchDB will have to be made with valid
credentials, effectively forbidding any anonymous requests.

The new `require_valid_user_except_for_up` is an off-by-default setting
that was meant to allow requiring valid credentials for all endpoints
except for the `/_up` endpoint.

However, the implementation of this made an error that lead to not
enforcing credentials on any endpoint, when enabled.

CouchDB versions 3.0.1[1] and 3.1.0[2] fix this issue.


Users who have not enabled `require_valid_user_except_for_up` are not

Users who have it enabled can either disable it again, or upgrade to
CouchDB versions 3.0.1[1] and 3.1.0[2].


On behalf of the CouchDB Security team,
Jan LehnardT

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.