Session credential theft via unscrubbed request headers

Information exposure in Apache CouchDB 3.3.2 and earlier allows remote authenticated users to steal session credentials via design functions. The query-server dispatcher passes the user request object, including authorization and cookie headers, to list, show, rewrite, and update functions instead of scrubbing those fields. Exploitation requires permission to insert a design document and user interaction with its function, which can return credentials externally or store them in a local document.