PT-2023-4572 · Mongodb · Mongodb Server+1

Adrian Gonzalez Montemayor + 1 · Publicado 2023-03-02 · Atualizado 2024-03-06 · CVE-2023-1409

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MongoDB Server versions 4.4 through 6.3 MongoDB Server versions 5.0.0 through 5.0.14

Description The issue is related to incorrect client certificate validation when the MongoDB Server is configured to use TLS with specific configuration options on Windows or macOS. This potentially allows a client to establish a TLS connection with the server by supplying any certificate.

Recommendations For MongoDB Server version 4.4, update to a version that includes the fix for this issue. For MongoDB Server version 5.0, update to a version later than 5.0.14. For MongoDB Server version 6.3, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting TLS connections to only trusted clients until a patch is available. Restrict access to the MongoDB Server to minimize the risk of exploitation.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

BDU:2023-04979

BIT-MONGODB-2023-1409

CVE-2023-1409

Produtos afetados

Mongodb Server

Mongodb

Referências · 14

• https://t.me/cibsecurity/69075 · Publicação no Telegram
• https://jira.mongodb.org/browse/SERVER-73662 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1409 · Nota
• https://vuldb.com/ru/?id.237879 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1409 · Nota de Segurança
• https://jira.mongodb.org/browse/SERVER-77028 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-1409 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04979 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-1409 · Nota de Segurança
• https://security.netapp.com/advisory/ntap-20230921-0007 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1409 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-1409 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-mongodb-2023-1409 · Aviso do Fabricante
• https://t.me/cvenotify/57547 · Publicação no Telegram