CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.

Apache CouchDB PMC reports :

Database Administrator could achieve privilege escalation to the account that CouchDB runs under, by abusing insufficient validation in the HTTP API, escaping security controls implemented in previous releases.

CVE-2017-12635 Prevent non-admin users to give themselves admin privileges.

CVE-2017-12636 Blacklist some configuration options to prevent execution of arbitrary shell commands as the CouchDB user

For Debian 7 'Wheezy', these problems have been fixed in version 1.2.0-5+deb7u1.

We recommend that you upgrade your couchdb packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CouchDB ver. 1.7.1

  - Fixed CVE-2017-12635

  - Fixed CVE-2017-12636

  - Switched to eunit for testing

  - Erlang 20 compatible

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201711-16 (CouchDB: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in CouchDB. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary shell commands or escalate       privileges.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
111018	FreeBSD : couchdb -- multiple vulnerabilities (1e54d140-8493-11e8-a795-0028f8d09152)	Nessus	FreeBSD Local Security Checks	critical
106208	Debian DLA-1252-1 : couchdb security update	Nessus	Debian Local Security Checks	critical
105943	Fedora 27 : couchdb / erlang-jiffy (2017-a20d92573b)	Nessus	Fedora Local Security Checks	critical
104697	GLSA-201711-16 : CouchDB: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2017-12636

high

Tenable Plugins

critical

critical

critical

critical