CVE-2019-11467: Buffer Overflow
In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, <, >, it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer service to crash and restart. This has been remedied in versions 5.1.2 and 5.5.2 to ensure buffer always grows as needed for any input.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-11467?
CVE-2019-11467 is a vulnerability in Couchbase Server 4.6.3 and 5.5.0 that allows an attacker to crash the indexer service by encoding certain characters in secondary index entries.
How severe is CVE-2019-11467?
CVE-2019-11467 has a severity rating of 7.5, which is considered high.
What is the affected software for CVE-2019-11467?
The affected software for CVE-2019-11467 is Couchbase Server versions 4.6.3 and 5.5.0.
How can I fix CVE-2019-11467?
To fix CVE-2019-11467, it is recommended to upgrade to a version of Couchbase Server that is not affected by this vulnerability.
Where can I find more information about CVE-2019-11467?
More information about CVE-2019-11467 can be found at the following link: https://www.couchbase.com/resources/security#SecurityAlerts