SUSE-SU-2018:2578-1: important: Security update for couchdb

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for couchdb
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:2578-1
Rating:             important
References:         #1068386 #1100973 
Cross-References:   CVE-2017-12636 CVE-2018-8007
Affected Products:
                    SUSE OpenStack Cloud 7
                    SUSE Enterprise Storage 4
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for couchdb to 1.7.2 fixes the following security issues:

   - CVE-2018-8007: Apache CouchDB administrative users can configure the
     database server via HTTP(S). Due to insufficient validation of
     administrator-supplied configuration settings via the HTTP API, it was
     possible for a CouchDB administrator user to escalate their privileges
     to that of the operating system's user that CouchDB runs under, by
     bypassing the blacklist of configuration settings that are not allowed
     to be modified via the HTTP API (bsc#1100973).
   - CVE-2017-12636: CouchDB administrative users can configure the database
     server via HTTP(S). Some of the configuration options include paths for
     operating system-level binaries that are subsequently launched by
      CouchDB. This allowed an admin user in Apache CouchDB to execute
      arbitrary shell commands as the CouchDB user (bsc#1068386).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud 7:

      zypper in -t patch SUSE-OpenStack-Cloud-7-2018-1807=1

   - SUSE Enterprise Storage 4:

      zypper in -t patch SUSE-Storage-4-2018-1807=1



Package List:

   - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64):

      couchdb-1.7.2-2.8.2
      couchdb-debuginfo-1.7.2-2.8.2
      couchdb-debugsource-1.7.2-2.8.2

   - SUSE Enterprise Storage 4 (aarch64 x86_64):

      couchdb-1.7.2-2.8.2
      couchdb-debuginfo-1.7.2-2.8.2
      couchdb-debugsource-1.7.2-2.8.2


References:

   https://www.suse.com/security/cve/CVE-2017-12636.html
   https://www.suse.com/security/cve/CVE-2018-8007.html
   https://bugzilla.suse.com/1068386
   https://bugzilla.suse.com/1100973