Paper/Archive/CVE-2024-1351

CVE-2024-1351

MongoDB Inc MongoDB Server — MongoDB Server may allow successful untrusted connection

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 42.8.428 × 208.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.

Affected

ProductAffectedFixed inSource

MongoDB Server7.0 – 7.0.5–CNA

MongoDB Server6.0 – 6.0.13–CNA

MongoDB Server5.0 – 5.0.24–CNA

MongoDB Server4.4 – 4.4.28–CNA

mongodb7.0 – 7.0.5–CISA-ADP

mongodb6.0 – 6.0.13–CISA-ADP

mongodb5.0 – 5.0.24–CISA-ADP

mongodb4.4 – 4.4.28–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

mongodb (CNA)8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refjira.mongodb.org/browse/SERVER-72839 refmongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024 refmongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024 refmongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024 refmongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024 refsecurity.netapp.com/advisory/ntap-20240524-0010