Denial of service via malformed network packet (MongoDB Inc. MongoDB Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.68 % · percentile 77 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mongodb
- NVD status
- Modified
Description
An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | mongodb |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2019-11455
- GCVE · GCVE-0-2019-20925
Affected configurations (NVD CPE)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.24cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 3.6.0 < 3.6.15cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.13cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.1
Affected products
| Product | Versions |
|---|---|
| MongoDB Inc. · MongoDB Server | affected 4.2 < 4.2.1 ; affected 4.0 < 4.0.13 ; affected 3.6 < 3.6.15 ; affected 3.4 < 3.4.24 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |