CVE-2023-45875: Private Key Leak in Couchbase Server 7.2.0
Summary
CVE-2023-45875: An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster. Affects couchbase versions 0.10 – 4.1.9rc1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Couchbase is a popular package available on PyPI that provides a Python client for Couchbase Server, a NoSQL document database. It allows developers to interact with the database using Python and provides features such as key-value operations, querying, and indexing. Couchbase Server 7.2.0 is the affected version in this vulnerability.
Vulnerability Detail
The vulnerability identified as CVE-2023-45875 is a private key leak in Couchbase Server 7.2.0. When adding a pre-7.0 node to a 7.2 cluster, the private key is leaked in the debug.log file. This can lead to unauthorized access to sensitive information and potential compromise of the Couchbase Server.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by upgrading to the patched version of Couchbase Server.
Conclusion
In conclusion, the vulnerability CVE-2023-45875 in Couchbase Server 7.2.0 exposes private keys in the debug.log file. To fix this issue, it is crucial to upgrade to the latest patched version of Couchbase Server. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for couchbase →
FAQ
The vulnerability can result in the exposure of private keys, which can lead to unauthorized access and compromise of the Couchbase Server.
You can use Vulert's playground at Vulert Scanner to check if your Couchbase Server is affected by this vulnerability. Simply provide your Pipfile.lock and it will alert you in real-time.
There are no known exploits available at the moment. However, it is crucial to apply the fix as soon as possible to prevent any potential attacks.
No, upgrading to the patched version is the recommended approach to mitigate the risk effectively.
You can find more information about this vulnerability in the Couchbase advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/couchbase/PYSEC-2023-235.yaml
Related vulnerabilities
Recent vulnerabilities recorded for couchbase.
