CVE-2019-11497

In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This has been fixed in version 5.5.0. XDCR now checks the validity of the certificate thoroughly and prevents a remote cluster reference from being created with an invalid certificate.

• CWE-295

• https://www.couchbase.com/resources/security#SecurityAlertsVendor Advisory
• https://www.couchbase.com/resources/security#SecurityAlertsVendor Advisory

Published

Sep 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11490An issue was discovered in Npcap 0.992. Sending a malformed …
• CVE-2019-11492ProjectSend before r1070 writes user passwords to the server…
• CVE-2019-11493VeryPDF 4.1 has a Memory Overflow leading to Code Execution …
• CVE-2019-11494In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the sub…7.5
• CVE-2019-11495In Couchbase Server 5.1.1, the cookie used for intra-node co…9.8
• CVE-2019-11496In versions of Couchbase Server prior to 5.0, the bucket nam…9.1
• CVE-2019-11498WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in…6.5
• CVE-2019-11499In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the sub…7.5
• CVE-2019-1150A remote code execution vulnerability exists when the Window…8.8
• CVE-2019-11500In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pig…
• CVE-2019-11502snap-confine in snapd before 2.38 incorrectly set the owners…
• CVE-2019-11503snap-confine as included in snapd before 2.39 did not guard …