WS-2019-0495

cockroachDB versions v2.1.0-alpha.20180702 to v19.2.0-alpha.20190606 are vulnerable to information disclosure. An attacker connected to a node may browse the web page and get the exact version number of cockroachDB...

WS-2018-0630

“cockroachdb/cockroach” vbeta-20161027 to v2.1.0-beta.20181008 are vulnerable against user enumeration as a result of different authentication errors...

WS-2018-0632

cockroachdb versions v1.0-rc.1 to v2.2.0-alpha.00000000 is vulnerable to user enumeration attack due to inadequate error message shown during user input validation...

WS-2018-0633

CockroachDB versions v1.2-alpha.20171113 to v2.0.5 and v2.1.0-alpha.00000000 to v2.1.0-beta.20180924 are vulnerable to Authentication Bypass. All RPCs other than roachpb.Batch RPC were open to the public, even when the server was running in secure mode...

WS-2018-0631

In “cockroachdb/cockroach”, v1.2-alpha.20171211 to v2.0-alpha.20180129 allow the setting of a user's password in an insecure mode, thus risking the confidealty...

Denial Of Service (DoS)

github.com/cockroachdb/cockroach is vulnerable to denial of service DoS attacks. getPrepareType throws an index out of range error when it is given an empty readBuffer, causing the application to crash. This flaw was exploitable through the v3Conn...

SQL Injection

github.com/cockroachdb/cockroach is vulnerable to SQL injections. The library doesn't use placeholders for its input variables, allowing a malicious user to insert escape characters into the query to execute arbitrary SQL commands...