Summary
MongoDB heeft meerdere kwetsbaarheden verholpen in MongoDB Server.
Details
Interpretaties
De kwetsbaarheden betreffen verschillende onderdelen van MongoDB Server. Een kwetsbaarheid in de loggingmechanismen kan ertoe leiden dat volledige authenticatiegegevens, inclusief gevoelige credentials, zonder redactie worden vastgelegd in serverlogs tijdens SASL-authenticatiesessies. Een andere kwetsbaarheid in de BSON-validatie veroorzaakt een crash van het mongod-proces door onbeheersbare wederzijdse recursie bij de validatie van geneste binaire data, wat resulteert in een denial-of-service.
Oplossingen
MongoDB heeft updates uitgebracht om de kwetsbaarheden in MongoDB Server te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 14
-
High 8.1
Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with a…
-
High 7.5
Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual rec…
-
High 7.5
Authenticate command with specific mechanism parameter can trigger server crash
When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth …
-
Medium 6.5
Client side encryption fails to encrypt values in a $vectorSearch
A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent t…
-
Medium 6.5
Aggregation sub-pipeline null dereference may allow DoS via crafted getMore
In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operati…
-
Medium 6.5
Server crashes in case of the use of exchange
When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.
-
Medium 6.5
Crafted cross-shard merge aggregation crashes MongoDB Server
Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.
-
Medium 6.5
$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $f…
-
Medium 6.5
Using MaxKey() may crash the server
This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many r…
-
Medium 6.5
Metadata name collision on $-prefixed fields causes post-auth server crash
An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document field…
-
Medium 6.5
GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation
An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, bu…
-
Medium 6.5
Stack memory disclosure in filemd5 command
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command
-
Medium 5.5
Keyfile contents are in MongoDB Server logs
MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.
-
Medium 5.5
Sensitive data could be written to mongod.log
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://jira.mongodb.org/browse/SERVER-122207
-
Reference
https://jira.mongodb.org/browse/SERVER-123370
-
Reference
https://jira.mongodb.org/browse/SERVER-123440
-
Reference
https://jira.mongodb.org/browse/SERVER-123507
-
Reference
https://jira.mongodb.org/browse/SERVER-123633
-
Reference
https://jira.mongodb.org/browse/SERVER-123688
-
Reference
https://jira.mongodb.org/browse/SERVER-123918
-
Reference
https://jira.mongodb.org/browse/SERVER-123951
-
Reference
https://jira.mongodb.org/browse/SERVER-124031
-
Reference
https://jira.mongodb.org/browse/SERVER-124183
-
Reference
https://jira.mongodb.org/browse/SERVER-124190
-
Reference
https://jira.mongodb.org/browse/SERVER-124959
-
Reference
https://jira.mongodb.org/browse/SERVER-125063
-
Reference
https://jira.mongodb.org/browse/SERVER-126506