17.5. CVE-2012-5649: JSONP arbitrary code execution with Adobe Flash

17.5.1. Description

A hand-crafted JSONP callback and response can be used to run arbitrary codeinside client-side browsers via Adobe Flash.

17.5.2. Mitigation

Upgrade to a supported CouchDB release that includes this fix, such as:

• 1.0.4
• 1.1.2
• 1.2.1
• 1.3.x
  All listed releases have included a specific fix.

17.5.3. Work-Around

Disable JSONP or don’t enable it since it’s disabled by default.

原文: http://docs.couchdb.org/en/stable/cve/2012-5649.html