PT-2023-4650 · Mongodb+2 · Mongodb Php Driver+5

Daria Pardue + 1 · Publicado 2023-08-29 · Atualizado 2025-05-20 · CVE-2021-32050

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MongoDB C Driver versions 1.0.0 through 1.17.7 MongoDB PHP Driver versions 1.0.0 through 1.9.2 MongoDB Swift Driver versions 1.0.0 through 1.1.1 MongoDB Node.js Driver 3.6 versions 3.6 through 3.6.10 MongoDB Node.js Driver 4.0 versions 4.0 through 4.17.0 MongoDB Node.js Driver 5.0 versions 5.0 through 5.8.0 MongoDB C++ Driver versions prior to 3.7.0

Description Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature, which is not enabled by default.

Recommendations For MongoDB C Driver versions 1.0.0 through 1.17.7, update to version 1.17.7 or later. For MongoDB PHP Driver versions 1.0.0 through 1.9.2, update to version 1.9.2 or later. For MongoDB Swift Driver versions 1.0.0 through 1.1.1, update to version 1.1.1 or later. For MongoDB Node.js Driver 3.6 versions 3.6 through 3.6.10, update to version 3.6.10 or later. For MongoDB Node.js Driver 4.0 versions 4.0 through 4.17.0, update to version 4.17.0 or later. For MongoDB Node.js Driver 5.0 versions 5.0 through 5.8.0, update to version 5.8.0 or later. For MongoDB C++ Driver versions prior to 3.7.0, update to version 3.7.0 or later. As a temporary workaround, consider disabling the command listener feature until a patch is available.

Correção

Information Disclosure

Insertion into Log File

Enumeração de Fraquezas

CWE-200

CWE-532

Identificadores relacionados

BDU:2023-05059

CVE-2021-32050

DLA-4175-1

GHSA-VXVM-QWW3-2FH7

Produtos afetados

Astra Linux

Debian

Mongodb C Driver

Mongodb Node.Js Driver

Mongodb Php Driver

Mongodb Swift Driver

Referências · 44

• https://github.com/mongodb/node-mongodb-native/commit/8c8b4c3b8c55f10fb96f63d3bbfa5d408b4ed7d0 · Nota
• https://github.com/mongodb/mongo-php-driver/pull/1235 · Nota
• https://github.com/mongodb/mongo-php-driver/commit/4495de8313c0d313e4dde906fc7aedf998ee3748 · Nota
• https://github.com/mongodb/mongo-swift-driver/pull/643 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0437 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32050 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-07887 · Nota de Segurança
• https://jira.mongodb.org/browse/CXX-2028 · Aviso do Fabricante
• https://jira.mongodb.org/browse/SWIFT-1229 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-32050 · Nota de Segurança
• https://safe-surf.ru/specialists/bulletins-nkcki/722424 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-03276 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6381 · Nota de Segurança
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=158612043 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/mongo-c-driver · Aviso do Fabricante