CouchDB: Multiple vulnerabilities — GLSA 201812-06

Multiple vulnerabilities have been found in CouchDB, the worst of which could lead to the remote execution of code.

Affected Packages

dev-db/couchdb on all architectures
Affected versions <= 2.1.2
Unaffected versions

Background

Apache CouchDB is a distributed, fault-tolerant and schema-free document-oriented database.

Description

Multiple vulnerabilities have been discovered in CouchDB. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could execute arbitrary code or escalate privileges.

Workaround

There is no known workaround at this time.

Resolution

Gentoo has discontinued support for CouchDB and recommends that users unmerge the package:

 # emerge --unmerge "dev-db/couchdb"
 

References

Release Date
December 15, 2018

Latest Revision
December 15, 2018: 1

Severity
normal

Exploitable
remote

Bugzilla entries