CVE-2010-0009: Infoleak
Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
Other sources
Apache CouchDB upstream has released latest, v0.11.0 version, addressing timing attack flaw(s). More from Bugtraq post: [1] http://seclists.org/bugtraq/2010/Mar/254
"Apache CouchDB versions prior to version 0.11.0 are vulnerable to timing attacks, also known as side-channel information leakage, due to using simple break-on-inequality string comparisons when verifying hashes and passwords."
References: [2] http://wiki.apache.org/couchdb/Breakingchanges [3] http://codahale.com/a-lesson-in-timing-attacks/ [4] http://couchdb.apache.org/ [5] http://couchdb.apache.org/downloads.html
Credit: Jason Davies of the Apache CouchDB development team
CVE Request for Apache CouchDB v0.11.0: [6] http://www.openwall.com/lists/oss-security/2010/03/31/5
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0009?
CVE-2010-0009 is classified as a medium severity vulnerability due to its potential for data exposure via timing attacks.
How do I fix CVE-2010-0009?
To mitigate CVE-2010-0009, upgrade to Apache CouchDB version 0.11.0 or later which addresses the timing attack flaw.
What versions of Apache CouchDB are affected by CVE-2010-0009?
CVE-2010-0009 affects Apache CouchDB versions 0.8.0 through 0.10.1.
Can CVE-2010-0009 lead to sensitive data exposure?
Yes, CVE-2010-0009 can allow remote attackers to glean sensitive information by analyzing the completion timing of certain operations.
Is there a patch available for CVE-2010-0009?
Yes, the latest version 0.11.0 of Apache CouchDB includes a patch for the vulnerabilities described in CVE-2010-0009.