You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@couchdb.apache.org by GitBox <gi...@apache.org> on 2020/05/19 13:53:15 UTC
[GitHub] [couchdb-documentation] janl opened a new pull request #543: feat: new cve, woop
janl opened a new pull request #543:
URL: https://github.com/apache/couchdb-documentation/pull/543
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [couchdb-documentation] janl commented on a change in pull request #543: feat: new cve, woop
Posted by GitBox <gi...@apache.org>.
janl commented on a change in pull request #543:
URL: https://github.com/apache/couchdb-documentation/pull/543#discussion_r427323279
##########
File path: src/cve/2020-1955.rst
##########
@@ -0,0 +1,60 @@
+.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
+.. use this file except in compliance with the License. You may obtain a copy of
+.. the License at
+..
+.. http://www.apache.org/licenses/LICENSE-2.0
+..
+.. Unless required by applicable law or agreed to in writing, software
+.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+.. License for the specific language governing permissions and limitations under
+.. the License.
+
+.. _cve/2020-1955:
+
+===========================================================
+CVE-2020-1955: Apache CouchDB Remote Privilege Escalations
+===========================================================
+
+:Date: 19.05.2020
+
+:Affected: 3.0.0
+
+:Severity: Medium
+
+:Vendor: The Apache Software Foundation
+
+Description
+===========
+
+CouchDB version 3.0.0 shipped with a new configuration setting that
+governs access control to the entire database server called
+`require_valid_user_except_for_up`. It was meant as an extension to the
+long-standing setting `require_valid_user`, which in turn requires that
+any and all requests to CouchDB will have to be made with valid
+credentials, effectively forbidding any anonymous requests.
+
+The new `require_valid_user_except_for_up` is an off-by-default setting
+that was meant to allow requiring valid credentials for all endpoints
+except for the `/_up` endpoint.
+
+However, the implementation of this made an error that lead to not
+enforcing credentials on any endpoint, when enabled.
+
+CouchDB versions :ref:`3.0.1 <release/3.0.1>` and :ref:`3.1.0
+<release/3.1.0>` fix this issue.
+
+Mitigation
+==========
+
+Users who have not enabled `require_valid_user_except_for_up` are not
+affected.
+
+Users that have it enabled can either disable it again, or upgrade to
Review comment:
```suggestion
Users who have it enabled can either disable it again, or upgrade to
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [couchdb-documentation] janl merged pull request #543: feat: new cve, woop
Posted by GitBox <gi...@apache.org>.
janl merged pull request #543:
URL: https://github.com/apache/couchdb-documentation/pull/543
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [couchdb-documentation] flimzy commented on a change in pull request #543: feat: new cve, woop
Posted by GitBox <gi...@apache.org>.
flimzy commented on a change in pull request #543:
URL: https://github.com/apache/couchdb-documentation/pull/543#discussion_r427320908
##########
File path: src/cve/2020-1955.rst
##########
@@ -0,0 +1,60 @@
+.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
+.. use this file except in compliance with the License. You may obtain a copy of
+.. the License at
+..
+.. http://www.apache.org/licenses/LICENSE-2.0
+..
+.. Unless required by applicable law or agreed to in writing, software
+.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+.. License for the specific language governing permissions and limitations under
+.. the License.
+
+.. _cve/2020-1955:
+
+===========================================================
+CVE-2020-1955: Apache CouchDB Remote Privilege Escalations
+===========================================================
+
+:Date: 19.05.2020
+
+:Affected: 3.0.0
+
+:Severity: Medium
+
+:Vendor: The Apache Software Foundation
+
+Description
+===========
+
+CouchDB version 3.0.0 shipped with a new configuration setting that
+governs access control to the entire database server called
+`require_valid_user_except_for_up`. It was meant as an extension to the
+long standing setting `require_valid_user`, which in turn requires that
Review comment:
```suggestion
long-standing setting `require_valid_user`, which in turn requires that
```
##########
File path: src/cve/2020-1955.rst
##########
@@ -0,0 +1,60 @@
+.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
+.. use this file except in compliance with the License. You may obtain a copy of
+.. the License at
+..
+.. http://www.apache.org/licenses/LICENSE-2.0
+..
+.. Unless required by applicable law or agreed to in writing, software
+.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+.. License for the specific language governing permissions and limitations under
+.. the License.
+
+.. _cve/2020-1955:
+
+===========================================================
+CVE-2020-1955: Apache CouchDB Remote Privilege Escalations
+===========================================================
+
+:Date: 19.05.2020
+
+:Affected: 3.0.0
+
+:Severity: Medium
+
+:Vendor: The Apache Software Foundation
+
+Description
+===========
+
+CouchDB version 3.0.0 shipped with a new configuration setting that
+governs access control to the entire database server called
+`require_valid_user_except_for_up`. It was meant as an extension to the
+long standing setting `require_valid_user`, which in turn requires that
+any and all requests to CouchDB will have to be made with valid
+credentials, effectively forbidding any anonymous requests.
+
+The new `require_valid_user_except_for_up` is an off-by-default setting
+that was meant to allow requiring valid credentials for all endpoints
+except for the `/_up` endpoint.
+
+However, the implementation of this made an error that lead to not
+enforcing credentials on any endpoint, when enabled.
+
+CouchDB versions :ref:`3.0.1 <release/3.0.1>` and :ref:`3.1.0
+<release/3.1.0>` fix this issue.
+
+Mitigation
+==========
+
+Users that have not enabled `require_valid_user_except_for_up` are not
Review comment:
Minor nit; "that" is not incorrect, but "who" is probably more common, and less "objectifying", if that's a thing.
```suggestion
Users who have not enabled `require_valid_user_except_for_up` are not
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [couchdb-documentation] janl commented on a change in pull request #543: feat: new cve, woop
Posted by GitBox <gi...@apache.org>.
janl commented on a change in pull request #543:
URL: https://github.com/apache/couchdb-documentation/pull/543#discussion_r427324101
##########
File path: src/cve/2020-1955.rst
##########
@@ -0,0 +1,60 @@
+.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
+.. use this file except in compliance with the License. You may obtain a copy of
+.. the License at
+..
+.. http://www.apache.org/licenses/LICENSE-2.0
+..
+.. Unless required by applicable law or agreed to in writing, software
+.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+.. License for the specific language governing permissions and limitations under
+.. the License.
+
+.. _cve/2020-1955:
+
+===========================================================
+CVE-2020-1955: Apache CouchDB Remote Privilege Escalations
Review comment:
```suggestion
CVE-2020-1955: Apache CouchDB Remote Privilege Escalation
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [couchdb-documentation] janl commented on pull request #543: feat: new cve, woop
Posted by GitBox <gi...@apache.org>.
janl commented on pull request #543:
URL: https://github.com/apache/couchdb-documentation/pull/543#issuecomment-630837495
@flimzy ta!
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org