CVE-2020-9040
High
Description
Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker can leverage this flaw by crafting a cryptographically valid certificate that will be accepted by Java SDK's Netty component due to missing hostname verification.
SeverityHigh
CVSS7.5
Exploit probability—
ProductCouchbase Server Java Sdk
PublishedJun 8, 2020
First seenJun 8, 2020
How to fix
Update
- couchbase couchbase_server_java_sdk2.7.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| couchbase couchbase_server_java_sdk | 1.7.1 ≤ v < 2.7.1.1 | 2.7.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.