What is CVE-2019-11467?

CVE-2019-11467 is a high-severity vulnerability in Couchbase Server, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.5/10. Published 2019-09-10.

How severe is CVE-2019-11467?

High severity. CVSS v3 base score is 7.5 out of 10.

Buffer overflow in Couchbase Server

CVE-2019-11467

In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, <, >, it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer service to crash and restart. This has been remedied in versions 5.1.2 and 5.5.2 to ensure buffer always grows as needed for any input.

Vulnerability class: Buffer Overflow

EPSS: 0.013 (68.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Couchbase Couchbase_server — versions 4.6.3, 5.5.0
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-11467?: CVE-2019-11467 is a high-severity vulnerability in Couchbase Server, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.5/10. Published 2019-09-10.
How severe is CVE-2019-11467?: High severity. CVSS v3 base score is 7.5 out of 10.