2.16. CVE-2023-26268: Apache CouchDB: Information sharing via couchjs processes — Apache CouchDB® 3.4 Documentation

# 2.16. CVE-2023-26268: Apache CouchDB: Information sharing via couchjs processes

Date:

  02.05.2023

Affected:

  3.3.1 and below, 3.2.2 and below

Severity:

  Medium

Vendor:

  The Apache Software Foundation

## 2.16.1. Description

Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:

> - validate_doc_update

> - list

> - filter

> - filter views (using view functions as filters)

> - rewrite

> - update

This doesn’t affect map/reduce or search (Dreyfus) index functions.

## 2.16.2. Mitigation

CouchDB 3.3.2 and 3.2.3 and onwards matches Javascript execution processes by database names in addition to design document IDs when processing the affected design document functions.

## 2.16.3. Workarounds

Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.

## 2.16.4. Credit

This issue was identified by Nick Vatamaniuc