You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by ja...@apache.org on 2026/10/20 09:57:34 UTC
(couchdb) 01/02: feat: add summer 2026 CVE entries, sort manually in TOC
This is an automated email from the ASF dual-hosted git repository.
janl pushed a commit to branch feat/docs-summary
in repository https://gitbox.apache.org/repos/asf/couchdb.git
commit 4562e9b77144a652d012221d924629980094b4d5
Author: Jan Lehnardt <ja...@apache.org>
AuthorDate: Fri Oct 16 15:39:55 2026 +0200
feat: add summer 2026 CVE entries, sort manually in TOC
---
src/docs/src/cve/2026-107755.rst | 53 +++++++++++++++++++++++++++++++++++++
src/docs/src/cve/2026-86471.rst | 51 +++++++++++++++++++++++++++++++++++
src/docs/src/cve/2026-90797.rst | 49 ++++++++++++++++++++++++++++++++++
src/docs/src/cve/2026-90798.rst | 49 ++++++++++++++++++++++++++++++++++
src/docs/src/cve/2026-90799.rst | 57 ++++++++++++++++++++++++++++++++++++++++
src/docs/src/cve/2026-90800.rst | 55 ++++++++++++++++++++++++++++++++++++++
src/docs/src/cve/index.rst | 24 ++++++++++++++++-
7 files changed, 337 insertions(+), 1 deletion(-)
diff --git a/src/docs/src/cve/2026-107755.rst b/src/docs/src/cve/2026-107755.rst
new file mode 100644
index 000000000..7de8c3875
--- /dev/null
+++ b/src/docs/src/cve/2026-107755.rst
@@ -0,0 +1,53 @@
+.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
+.. use this file except in compliance with the License. You may obtain a copy of
+.. the License at
+..
+.. http://www.apache.org/licenses/LICENSE-2.0
+..
+.. Unless required by applicable law or agreed to in writing, software
+.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+.. License for the specific language governing permissions and limitations under
+.. the License.
+
+.. _cve/2026-107755:
+
+===========================================================================
+CVE-2026-107755: |longtitle|
+===========================================================================
+
+.. |longtitle| replace:: Credential Disclosure via Object-Form Replication URLs
+ in ``_replicator``
+
+:Date: 12.10.2026
+
+:Affected: 3.5.2 and below
+
+:Severity: High
+
+:Vendor: The Apache Software Foundation
+
+Description
+===========
+
+The CouchDB ``/_replicator`` database (and prefixed variants) allow
+specification of source and target credentials in two forms: as a URL string and
+as a URL object. When non-owner users retrieve a replication documents, CouchDB
+obfuscates credentials only in the URL string case. URL objects will show non-
+owners the credentials.
+
+Mitigation
+==========
+
+URL objects in replication docs are now correctly obfuscating credentials for
+non-owners.
+
+Workarounds
+===========
+
+N/A
+
+Credit
+======
+
+Sakil Ahamed Gayen
diff --git a/src/docs/src/cve/2026-86471.rst b/src/docs/src/cve/2026-86471.rst
new file mode 100644
index 000000000..f34ebbd1c
--- /dev/null
+++ b/src/docs/src/cve/2026-86471.rst
@@ -0,0 +1,51 @@
+.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
+.. use this file except in compliance with the License. You may obtain a copy of
+.. the License at
+..
+.. http://www.apache.org/licenses/LICENSE-2.0
+..
+.. Unless required by applicable law or agreed to in writing, software
+.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+.. License for the specific language governing permissions and limitations under
+.. the License.
+
+.. _cve/2026-86471:
+
+====================================================================================
+CVE-2026-86471: Admin credentials leading to code execution as operating system user
+====================================================================================
+
+:Date: 12.10.2026
+
+:Affected: 3.5.2 and below
+
+:Severity: High
+
+:Vendor: The Apache Software Foundation
+
+Description
+===========
+
+CouchDB’s ``weatherreport`` diagnostics module used unsanitised configuration
+values to construct shell commands. This allows CouchDB server admins that can
+change config values at runtime using the ``/_config`` HTTP API to have CouchDB
+execute arbitrary shell commands as the operating system user that CouchDB run
+on.
+
+Mitigation
+==========
+
+CouchDB no longer constructs shell commands from unsanitised configuration
+values and avoids using shell commands where possible to achieve the same
+functionality.
+
+Workarounds
+===========
+
+N/A
+
+Credit
+======
+
+The reporter of this issue has asked to remain anonymous.
diff --git a/src/docs/src/cve/2026-90797.rst b/src/docs/src/cve/2026-90797.rst
new file mode 100644
index 000000000..0b7922a54
--- /dev/null
+++ b/src/docs/src/cve/2026-90797.rst
@@ -0,0 +1,49 @@
+.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
+.. use this file except in compliance with the License. You may obtain a copy of
+.. the License at
+..
+.. http://www.apache.org/licenses/LICENSE-2.0
+..
+.. Unless required by applicable law or agreed to in writing, software
+.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+.. License for the specific language governing permissions and limitations under
+.. the License.
+
+.. _cve/2026-90797:
+
+=================================================================================
+CVE-2026-90797: Pre-authentication gzip decompression bomb via ``POST /_session``
+=================================================================================
+
+:Date: 12.10.2026
+
+:Affected: 3.5.2 and below
+
+:Severity: High
+
+:Vendor: The Apache Software Foundation
+
+Description
+===========
+
+CouchDB allows for gzip compressed request bodies to unauthenticated endpoints
+like ``/_session``. Only the compressed input is subject to request body
+limitations. This allows highly compressed gzip streams to produce out of memory
+scenarios for CouchDB’s ``beam.smp`` process.
+
+Mitigation
+==========
+
+HTTP request body decompression now happens in chunks and at each iteration,
+the uncompressed output length is subject to the request body limit.
+
+Workarounds
+===========
+
+N/A
+
+Credit
+======
+
+ZeroVuln labs
diff --git a/src/docs/src/cve/2026-90798.rst b/src/docs/src/cve/2026-90798.rst
new file mode 100644
index 000000000..034d3e691
--- /dev/null
+++ b/src/docs/src/cve/2026-90798.rst
@@ -0,0 +1,49 @@
+.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
+.. use this file except in compliance with the License. You may obtain a copy of
+.. the License at
+..
+.. http://www.apache.org/licenses/LICENSE-2.0
+..
+.. Unless required by applicable law or agreed to in writing, software
+.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+.. License for the specific language governing permissions and limitations under
+.. the License.
+
+.. _cve/2026-90798:
+
+===========================================================================
+CVE-2026-90798: Replicator follows redirects indefinitely
+===========================================================================
+
+:Date: 12.10.2026
+
+:Affected: 3.5.2 and below
+
+:Severity: Medium
+
+:Vendor: The Apache Software Foundation
+
+Description
+===========
+
+The CouchDB replicator follows HTTP redirects indefinitely. This allowed a
+malicious replication endpoint to cause a denial of service for individual
+replication jobs.
+
+Mitigation
+==========
+
+Existing retry limits are now applied for all replicator requests. After 5
+retries the replication job fails with a ``too_many_redirects error``.
+
+Workarounds
+===========
+
+N/A
+
+Credit
+======
+
+The CouchDB team discovered this issue while reviewing independent reports from
+Piotr Karwasz, Sec-Rex & ZeroVuln Labs.
diff --git a/src/docs/src/cve/2026-90799.rst b/src/docs/src/cve/2026-90799.rst
new file mode 100644
index 000000000..76ff1df68
--- /dev/null
+++ b/src/docs/src/cve/2026-90799.rst
@@ -0,0 +1,57 @@
+.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
+.. use this file except in compliance with the License. You may obtain a copy of
+.. the License at
+..
+.. http://www.apache.org/licenses/LICENSE-2.0
+..
+.. Unless required by applicable law or agreed to in writing, software
+.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+.. License for the specific language governing permissions and limitations under
+.. the License.
+
+.. How to reference a release: :ref:`3.3.3 <release/3.3.3>`
+
+.. _cve/2026-90799:
+
+===========================================================================
+CVE-2026-90799: |longtitle|
+===========================================================================
+
+.. |longtitle| replace:: Atom-table exhaustion in ``_changes`` sequences and
+ ``_search`` bookmarks with specially crafted sequence values
+
+:Date: 12.10.2026
+
+:Affected: 3.5.2 and below
+
+:Severity: High
+
+:Vendor: The Apache Software Foundation
+
+Description
+===========
+
+CouchDB makes opaque byte sequences available to clients to be passed back for
+resuming operations. These byte sequences are translated into Erlang terms.
+As long as only terms are supplied that have been emitted by CouchDB, no
+problems occur. But since clients can construct their own byte sequences,
+CouchDB can be tricked into allocating Erlang ``atom`` data types until the
+internal atom table capacity is exhausted. This causes the Erlang VM BEAM to
+hard abort, causing a denial of service.
+
+Mitigation
+==========
+
+CouchDB is now safely parsing byte sequences in a way that does not create
+new atoms.
+
+Workarounds
+===========
+
+N/A
+
+Credit
+======
+
+Piotr Karwasz & ZeroVuln Labs reported this issue independently.
diff --git a/src/docs/src/cve/2026-90800.rst b/src/docs/src/cve/2026-90800.rst
new file mode 100644
index 000000000..d8a8996bd
--- /dev/null
+++ b/src/docs/src/cve/2026-90800.rst
@@ -0,0 +1,55 @@
+.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
+.. use this file except in compliance with the License. You may obtain a copy of
+.. the License at
+..
+.. http://www.apache.org/licenses/LICENSE-2.0
+..
+.. Unless required by applicable law or agreed to in writing, software
+.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+.. License for the specific language governing permissions and limitations under
+.. the License.
+
+.. _cve/2026-90800:
+
+===========================
+CVE-2026-90800: |longtitle|
+===========================
+
+.. |longtitle| replace:: Auth bypass in prefixed Apache CouchDB ``_users`` and
+ ``_replicator`` databases
+
+:Date: 12.10.2026
+
+:Affected: 3.5.2 and below
+
+:Severity: High
+
+:Vendor: The Apache Software Foundation
+
+Description
+===========
+
+CouchDB supports multiple instances of the system databases ``_users`` and
+``_replicator``. They are differentiated with a prefix, for example
+``/foo/_users`` or ``/bar/_replicator``. These databases behave exactly like
+the base system databases, but allow bespoke access control for their contents.
+
+The restriction of allowing only server and database admins to use the
+``_all_docs`` and ``_changes`` API endpoints on those prefixed system databases
+was not enforced.
+
+Mitigation
+==========
+
+The admin-only restriction is now enforced.
+
+Workarounds
+===========
+
+N/A
+
+Credit
+======
+
+Qing Xu & ZeroVuln Labs reported this issue independently.
diff --git a/src/docs/src/cve/index.rst b/src/docs/src/cve/index.rst
index 9e5f9df15..1360827e1 100644
--- a/src/docs/src/cve/index.rst
+++ b/src/docs/src/cve/index.rst
@@ -27,7 +27,29 @@ Further backports may be published at our discretion.
:maxdepth: 1
:glob:
- *
+ 2010-0009
+ 2010-2234
+ 2010-3854
+ 2012-5641
+ 2012-5649
+ 2012-5650
+ 2014-2668
+ 2017-12635
+ 2017-12636
+ 2018-11769
+ 2018-17188
+ 2018-8007
+ 2020-1955
+ 2021-38295
+ 2022-24706
+ 2023-26268
+ 2023-45725
+ 2026-86471
+ 2026-90797
+ 2026-90798
+ 2026-90799
+ 2026-90800
+ 2026-107755
.. _cve/report: