ArchLinux: 201711-24: couchdb: multiple issues
Summary
- CVE-2017-12635 (privilege escalation)
Due to differences in the Erlang-based JSON parser and JavaScript-based
JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x
before 2.1.1 to submit _users documents with duplicate keys for 'roles'
used for access control within the database, including the special case
'_admin' role, that denotes administrative users. In combination with
CVE-2017-12636 (remote command execution), this can be used to give
non-admin users access to arbitrary shell commands on the server as the
database system user. The JSON parser differences result in behaviour
that if two 'roles' keys are available in the JSON, the second one will
be used for authorising the document write, but the first 'roles' key
is used for subsequent authorization for the newly created user. By
design, users can not assign themselves roles. The vulnerability allows
non-admin users to give themselves admin privileges.
- CVE-2017-12636 (arbitrary command execution)
CouchDB administrative users can configure the database server via
HTTP(S). Some of the configuration options include paths for operating
system-level binaries that are subsequently launched by CouchDB. This
allows an admin user in Apache CouchDB before 1.7.0 and 2.x before
2.1.1 to execute arbitrary shell commands as the CouchDB user,
including downloading and executing scripts from the public internet.
Resolution
Upgrade to 2.1.1-1.
# pacman -Syu "couchdb>=2.1.1-1"
The problems have been fixed upstream in version 2.1.1.
References
https://lists.apache.org/thread/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E https://justi.cz/security/2017/11/14/couchdb-rce-npm.html https://github.com/apache/couchdb/commit/e01f3009b59a00d81dd1f6d4e807afab08b2d072 https://github.com/apache/couchdb/commit/da27d4dcc7a98c76486f97c356f1c0f4a614b48b https://security.archlinux.org/CVE-2017-12635 https://security.archlinux.org/CVE-2017-12636
![Dist Arch](/images/distros/dist-arch.png)
Workaround
None.