CVE-2023-45875: 
Couchbase vulnerability analysis and mitigation

An issue was discovered in Couchbase Server 7.2.0 where there is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster. This vulnerability was disclosed on November 8, 2023 and assigned identifier CVE-2023-45875 (NVD, Couchbase Alerts).

The vulnerability occurs specifically during the process of adding a pre-7.0 node to a 7.2 cluster, where the private key gets exposed in the debug.log file. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue has been classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The exposure of the private key in debug logs could potentially allow attackers who gain access to these logs to compromise the security of the system. This could lead to unauthorized access to sensitive information and potential system compromise (Couchbase Alerts).

The vulnerability has been fixed in Couchbase Server version 7.2.1. Users are advised to upgrade to this version or later to address the security issue (Couchbase Alerts).