CVE-2014-2668 Denial of service in n/a

What is CVE-2014-2668?

CVE-2014-2668 is a medium-severity denial of service vulnerability in n/a, published on 28 Mar 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids.

Weakness: CWE-20

Which versions are affected by CVE-2014-2668?

It affects 1 product.

Products include Apache Couchdb.

How do I fix CVE-2014-2668?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2014-2668 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-2668 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2022-24706 Apache CouchDB Insecure Default Initialization of Resource Exploited Critical 9.8
• CVE-2020-1955 Auth bypass in Apache CouchDB Critical 9.8
• CVE-2017-12635 Privilege escalation in Apache CouchDB Critical 9.8
• CVE-2018-14889 Code injection in n/a High 7.8
• CVE-2016-8742 Privilege escalation in Apache CouchDB High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pgjj-9j9g-vrr7, MGASA-2014-0203.