CouchDB Weekly News, July 12, 2018

Releases

Opinions and other News in the CouchDB Universe

CouchDB Use Cases, Questions and Answers

Stack Overflow:

no public answer yet:

PouchDB Use Cases, Questions and Answers

Stack Overflow:

For more new questions and answers about CouchDB, see these search results and about PouchDB, see these.

Get involved!

If you want to get into working on CouchDB:

  • We have an infinite number of open contributor positions on CouchDB. Submit a pull request and join the project!
  • Do you want to help us with the work on the new CouchDB website? Get in touch on our new website mailing list and join the website team! – www@couchdb.apache.org
  • The CouchDB advocate marketing programme is just getting started. Join us in CouchDB’s Advocate Hub!
  • CouchDB has a new wiki. Help us move content from the old to the new one!
  • Can you help with Web Design, Development or UX for our Admin Console? No Erlang skills required! – Get in touch with us.
  • Do you want to help moving the CouchDB docs translation forward? We’d love to have you in our L10n team! See our current status and languages we’d like to provide CouchDB docs in on this page. If you’d like to help, don’t hesitate to contact the L10n mailing list on l10n@couchdb.apache.org or ping Andy Wenk (awenkhh on IRC).

We’d be happy to welcome you on board!

Events

Job opportunities for people with CouchDB skills

… and also in the news

Submit news to the CouchDB Weekly

Reach out to us with your news suggestions by sending us an email or by contacting us on Twitter @CouchDB.

Apache CouchDB CVE-2018-8007

Overview of CVE-2018-8007

CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system’s user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API.

This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution, bypassing already disclosed CVE-2017-12636

Mitigation

All users should upgrade to CouchDB releases 1.7.2 or 2.1.2.

Upgrades from previous 1.x and 2.x versions in the same series should be
seamless.

Users on earlier versions, or users upgrading from 1.x to 2.x should consult
with upgrade notes.

Credit

This issue was discovered by Francesco Oddo of MDSec Labs. The CouchDB PMC gratefully acknowledges their support in responsibly disclosing this vulnerability.