Denial of service via malformed network packet (MongoDB Inc. MongoDB Server)
En bref
- Source
- NVD
- EPSS
- EPSS 1.68 % · centile 77 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mongodb
- Statut NVD
- Modified
Rechercher sur…
Description
An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.
Faiblesses (CWE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | mongodb |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-11455
- GCVE · GCVE-0-2019-20925
Configurations affectées (CPE NVD)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.24cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 3.6.0 < 3.6.15cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.13cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.1
Produits affectés
| Produit | Versions |
|---|---|
| MongoDB Inc. · MongoDB Server | affected 4.2 < 4.2.1 ; affected 4.0 < 4.0.13 ; affected 3.6 < 3.6.15 ; affected 3.4 < 3.4.24 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |