CVE-2018-17188 Code injection in Apache CouchDB

What is CVE-2018-17188?

CVE-2018-17188 is a high-severity code injection vulnerability in Apache CouchDB, published on 2 Jan 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full system entry for unauthenticated users. Rather than waiting for new vulnerabilities to be discovered, and fixing them as they come up, the CouchDB development team decided to make changes to avoid this entire class of vulnerabilities.

Which versions are affected by CVE-2018-17188?

It affects 1 product.

Products include Apache Couchdb.

How do I fix CVE-2018-17188?

No fix has been published for CVE-2018-17188 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-17188 being exploited?

There is no known exploitation of CVE-2018-17188 in the wild and no public exploit code.

Other vulnerabilities in Apache CouchDB

• CVE-2022-24706 Apache CouchDB Insecure Default Initialization of Resource Exploited Critical 9.8
• CVE-2020-1955 Auth bypass in Apache CouchDB Critical 9.8
• CVE-2017-12635 Privilege escalation in Apache CouchDB Critical 9.8
• CVE-2018-14889 Code injection in n/a High 7.8
• CVE-2016-8742 Privilege escalation in Apache CouchDB High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6c69-f4qc-5997, UBUNTU-CVE-2018-17188.