couchdb CVE-2017-12635 & CVE-2017-12636 (RCE) #31838

andir · 2017-11-19T21:11:55Z

There was an announcement [1] regarding two severe CVEs affecting couchdb.

I do not use couchdb myself so feedback from someone like @garbas or @rbvermaa would be nice.

Backporting should be considered for both versions (1.x & 2.x)

Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- other Linux distributions
Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

andir · 2017-11-19T21:13:10Z

nvm @fpletz already pushed that while I had it on my machine :-)

garbas · 2017-11-20T12:10:53Z

@andir tnx anyway.

andir added 3 commits November 19, 2017 21:46

couchdb: 1.6.1 -> 1.7.1 (addresses CVE-2017-12635 & CVE-2017-12636)

c0cc8f1

couchdb: renamed the 2.0.0.nix file to couchdb2.nix

b0398db

couchdb: 2.0.0 -> 2.1.1 (addresses CVE-2017-12635 & CVE-2017-12636)

ec5d15a

andir closed this Nov 19, 2017

andir deleted the fix-couchdb branch November 20, 2017 13:34

Provide feedback