PT-2020-19849 · Mongodb+1 · Mongodb Server+2

Published 2020-08-21 · Updated 2024-09-17 · CVE-2020-7923

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 4.4.0-rc7 MongoDB Server versions prior to 4.2.8 MongoDB Server versions prior to 4.0.19

Description A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear.

Recommendations For MongoDB Server versions prior to 4.4.0-rc7, update to version 4.4.0-rc7 or later. For MongoDB Server versions prior to 4.2.8, update to version 4.2.8 or later. For MongoDB Server versions prior to 4.0.19, update to version 4.0.19 or later.

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

ALT-PU-2022-3039

BIT-MONGODB-2020-7923

CVE-2020-7923

DLA-2344-1

MGASA-2021-0177

Affected Products

Alt Linux

Mongodb Server

Mongodb

References · 15

• https://debian.org/lts/security/2020/dla-2344 · Vendor Advisory
• https://jira.mongodb.org/browse/SERVER-47773 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0177.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7923 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0177 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2344-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7923 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mongodb-2020-7923 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7923 · Security Note
• https://ubuntu.com/security/CVE-2020-7923 · Vendor Advisory
• https://github.com/mongodb/mongo/commit/c8ced6df8f620daaa2e539f192f2eef356c63e9c · Note
• https://bugs.mageia.org/show_bug.cgi?id=27212 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7923 · Note
• https://t.me/cvenotify/94864 · Telegram Post