Publication date: October 1, 2018
Description
Some of CockroachDB’s internal GRPC interfaces for inter-node communication did not implement certificate validation correctly and could permit an unauthorized user to access the cluster.
Statement
On October 23rd, 2018, an internal review uncovered a security vulnerability within CockroachDB's GRPC layer. This vulnerability was prioritized for a fix and repaired in v1.1.9, v2.0.6 and v2.1-beta.20181001 on October 1st. All users are invited to upgrade immediately.
Registered users were informed privately of the issue and provided with early access to the fix, ahead of the public advisory.
This issue is tracked internally as #30821.
Mitigation
Affected deployments must prevent direct access to the GRPC protocol from non-privileged clients.
This can be achieved by firewalling access to the CockroachDB TCP port and use a PostgreSQL-compatible SQL load balancer to provide access to client applications instead of allowing direct TCP connections.
Impact
All deployments running CockroachDB up to and including revisions 1.1.8 and v2.0.5, and where the combined RPC/SQL TCP port is exposed to non-privileged users, are affected.
Exploiting this vulnerability would allow unauthenticated users to arbitrarily read and write to the stored data and control the availability of the cluster.
Questions about any technical alert can be directed to our support team.
Was this helpful?
