PT-2021-13892 · Mongodb · Mongodb Ops Manager

Published 2021-02-11 · Updated 2024-09-17 · CVE-2021-20335

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: MongoDB Ops Manager versions prior to and including 4.2.24 MongoDB Ops Manager versions prior to and including 4.4.12

Description: The issue occurs when upgrading MongoDB Ops Manager from versions prior to and including 4.2.24 to versions prior to and including 4.4.12, with multiple OM application servers and SSL turned on for their MongoDB processes. This triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. The issue is temporary and corrects itself after MongoDB Ops Manager instances finish upgrading to MongoDB Ops Manager 4.4. Customers must be running with clientCertificateMode=OPTIONAL or allowConnectionsWithoutCertificates=true to be impacted.

Recommendations: For MongoDB Ops Manager versions prior to and including 4.2.24, upgrade to MongoDB Ops Manager 4.4.13 or later to resolve the issue. For MongoDB Ops Manager versions prior to and including 4.4.12, upgrade to MongoDB Ops Manager 4.4.13 or later to resolve the issue. As a temporary workaround, consider monitoring the SSL status of the cluster members during the upgrade process to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2021-20335

Affected Products

Mongodb Ops Manager

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2021-20335 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-20335 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20335 · Vendor Advisory
• https://docs.opsmanager.mongodb.com/v4.2/release-notes/application/#onprem-server-4-2-23 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20335 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20335 · Vendor Advisory
• https://t.me/cvenotify/68379 · Telegram Post
• https://t.me/cvenotify/94860 · Telegram Post
• https://t.me/cvenotify/9784 · Telegram Post
• https://docs-opsmanager-staging.mongodb.com/docsworker-xlarge/DOCSP-14164/release-notes/application.html · Note
• https://t.me/cibsecurity/23425 · Telegram Post