PT-2020-6164 · Mongodb+1 · Mongodb Server+2

David Storch · Published 2020-05-21 · Updated 2024-09-16 · CVE-2020-7929

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 3.6.21 MongoDB Server versions prior to 4.0.20

Description A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries containing a type of regex. This issue is related to insufficient processing of regular expressions, which may allow a remote attacker to cause a denial of service or elevate their privileges.

Recommendations For MongoDB Server versions prior to 3.6.21, update to version 3.6.21 or later. For MongoDB Server versions prior to 4.0.20, update to version 4.0.20 or later. As a temporary workaround, consider restricting the use of regex in database queries to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-185

Related Identifiers

ALT-PU-2022-3039

BDU:2021-03388

BIT-MONGODB-2020-7929

CVE-2020-7929

Affected Products

Alt Linux

Mongodb Server

Mongodb

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2020-7929 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7929 · Vendor Advisory
• https://jira.mongodb.org/browse/SERVER-51083 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7929 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7929 · Security Note
• https://bdu.fstec.ru/vul/2021-03388 · Security Note
• https://osv.dev/vulnerability/BIT-mongodb-2020-7929 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7929 · Vendor Advisory
• https://t.me/cibsecurity/24298 · Telegram Post
• https://t.me/cvenotify/10673 · Telegram Post
• https://t.me/cvenotify/94812 · Telegram Post
• https://ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-mongodb-node-js-docker-and-xstream-affect-ibm-spectrum-protect-plus · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7929 · Note