Login
Newsletter
Werbung

Sicherheit: Zwei Probleme in couchdb
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in couchdb
ID: SUSE-SU-2018:2578-1
Distribution: SUSE
Plattformen: SUSE OpenStack Cloud 7, SUSE Enterprise Storage 4
Datum: Sa, 1. September 2018, 08:26
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12636
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8007
Applikationen: CouchDB

Originalnachricht

   SUSE Security Update: Security update for couchdb
______________________________________________________________________________

Announcement ID: SUSE-SU-2018:2578-1
Rating: important
References: #1068386 #1100973
Cross-References: CVE-2017-12636 CVE-2018-8007
Affected Products:
SUSE OpenStack Cloud 7
SUSE Enterprise Storage 4
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for couchdb to 1.7.2 fixes the following security issues:

- CVE-2018-8007: Apache CouchDB administrative users can configure the
database server via HTTP(S). Due to insufficient validation of
administrator-supplied configuration settings via the HTTP API, it was
possible for a CouchDB administrator user to escalate their privileges
to that of the operating system's user that CouchDB runs under, by
bypassing the blacklist of configuration settings that are not allowed
to be modified via the HTTP API (bsc#1100973).
- CVE-2017-12636: CouchDB administrative users can configure the database
server via HTTP(S). Some of the configuration options include paths for
operating system-level binaries that are subsequently launched by
CouchDB. This allowed an admin user in Apache CouchDB to execute
arbitrary shell commands as the CouchDB user (bsc#1068386).


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE OpenStack Cloud 7:

zypper in -t patch SUSE-OpenStack-Cloud-7-2018-1807=1

- SUSE Enterprise Storage 4:

zypper in -t patch SUSE-Storage-4-2018-1807=1



Package List:

- SUSE OpenStack Cloud 7 (aarch64 s390x x86_64):

couchdb-1.7.2-2.8.2
couchdb-debuginfo-1.7.2-2.8.2
couchdb-debugsource-1.7.2-2.8.2

- SUSE Enterprise Storage 4 (aarch64 x86_64):

couchdb-1.7.2-2.8.2
couchdb-debuginfo-1.7.2-2.8.2
couchdb-debugsource-1.7.2-2.8.2


References:

https://www.suse.com/security/cve/CVE-2017-12636.html
https://www.suse.com/security/cve/CVE-2018-8007.html
https://bugzilla.suse.com/1068386
https://bugzilla.suse.com/1100973

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung