SB2019091049 - Improper Certificate Validation in Couchbase Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019091049

SB2019091049 - Improper Certificate Validation in Couchbase Server

Published: September 10, 2019 Updated: August 8, 2020

Security Bulletin ID SB2019091049
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper Certificate Validation (CVE-ID: CVE-2019-11497)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This has been fixed in version 5.5.0. XDCR now checks the validity of the certificate thoroughly and prevents a remote cluster reference from being created with an invalid certificate.


Remediation

Install update from vendor's website.

References