CVE-2023-26268: Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes
Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: validatedocupdate
list
filter
filter views (using view functions as filters)
rewrite
update
This doesn't affect map/reduce or search (Dreyfus) index functions.
Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).
Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-26268?
CVE-2023-26268 is a vulnerability that affects Apache CouchDB and IBM Cloudant. Design documents with matching document IDs from databases on the same cluster may share a mutable Javascript environment when using certain design document functions.
What is the severity of CVE-2023-26268?
The severity of CVE-2023-26268 is medium, with a CVSS score of 5.3.
Which software is affected by CVE-2023-26268?
CVE-2023-26268 affects Apache CouchDB versions up to 3.2.3, Apache CouchDB versions between 3.3.0 and 3.3.2, and IBM Cloudant with a version up to 8349.
What can happen if CVE-2023-26268 is exploited?
If CVE-2023-26268 is exploited, design documents with matching IDs can share a mutable Javascript environment, potentially leading to unauthorized access or data manipulation.
How can I mitigate CVE-2023-26268?
To mitigate CVE-2023-26268, update Apache CouchDB to version 3.3.3 or later, or update IBM Cloudant to a version higher than 8349.