CVE-2010-0009
MEDIUM severity · CVSS 4.3 · Information disclosure
4.3CVSS MEDIUM
Summary
Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
Impact & exploitability
Attack vectorNetwork
Attack complexity—
Privileges required—
User interaction—
Confidentiality impact—
Integrity impactNone
Availability impactNone
Exploit probability (EPSS)5%
AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://couchdb.apache.org/security.html ↗
Additional information
- NVD record
- http://couchdb.apache.org/security.htmlPatch
- http://secunia.com/advisories/39146Advisory
- http://archives.neohapsis.com/archives/bugtraq/2010-03/0267.html
- http://www.osvdb.org/63350
- http://www.securityfocus.com/archive/1/510427/100/0/threaded
- http://www.securityfocus.com/bid/39116
- https://bugzilla.redhat.com/show_bug.cgi?id=578572