[manjaro-security] [arch-security] [ASA-201711-24] couchdb: multiple issues

Morten Linderud foxboron at archlinux.org
Thu Nov 16 19:28:38 CET 2017

Arch Linux Security Advisory ASA-201711-24

Severity: High
Date    : 2017-11-16
CVE-ID  : CVE-2017-12635 CVE-2017-12636
Package : couchdb
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-495


The package couchdb before version 2.1.1-1 is vulnerable to multiple
issues including privilege escalation and arbitrary command execution.


Upgrade to 2.1.1-1.

# pacman -Syu "couchdb>=2.1.1-1"

The problems have been fixed upstream in version 2.1.1.




- CVE-2017-12635 (privilege escalation)

Due to differences in the Erlang-based JSON parser and JavaScript-based
JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x
before 2.1.1 to submit _users documents with duplicate keys for 'roles'
used for access control within the database, including the special case
'_admin' role, that denotes administrative users. In combination with
CVE-2017-12636 (remote command execution), this can be used to give
non-admin users access to arbitrary shell commands on the server as the
database system user. The JSON parser differences result in behaviour
that if two 'roles' keys are available in the JSON, the second one will
be used for authorising the document write, but the first 'roles' key
is used for subsequent authorization for the newly created user. By
design, users can not assign themselves roles. The vulnerability allows
non-admin users to give themselves admin privileges.

- CVE-2017-12636 (arbitrary command execution)

CouchDB administrative users can configure the database server via
HTTP(S). Some of the configuration options include paths for operating
system-level binaries that are subsequently launched by CouchDB. This
allows an admin user in Apache CouchDB before 1.7.0 and 2.x before
2.1.1 to execute arbitrary shell commands as the CouchDB user,
including downloading and executing scripts from the public internet.


A remote authenticated non-admin user is able to escalate privileges
and execute arbitrary commands on the affected host.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20171116/eceabc58/attachment.sig>

More information about the manjaro-security mailing list