PT-2021-2652 · Mongodb · Mongodb Database Tools

Huan Li · Published 2021-04-12 · Updated 2024-09-16 · CVE-2020-7924

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MongoDB Database Tools versions 3.6.6 through 3.6.20 MongoDB Database Tools versions prior to 3.6.21 MongoDB Database Tools versions prior to 4.0.21 MongoDB Database Tools versions prior to 4.2.11 MongoDB Database Tools 100 versions prior to 100.2.0 Mongomirror 0 versions later than 0.6.0

Description The issue is related to the usage of a specific command line parameter in MongoDB Tools, which was originally intended to skip hostname checks but may result in MongoDB skipping all certificate validation, potentially accepting invalid certificates. This could allow a remote attacker to access and compromise confidential data.

Recommendations For MongoDB Database Tools versions 3.6.6 through 3.6.20, update to version 3.6.21 or later. For MongoDB Database Tools versions prior to 3.6.21, update to version 3.6.21 or later. For MongoDB Database Tools versions prior to 4.0.21, update to version 4.0.21 or later. For MongoDB Database Tools versions prior to 4.2.11, update to version 4.2.11 or later. For MongoDB Database Tools 100 versions prior to 100.2.0, update to version 100.2.0 or later. For Mongomirror 0 versions later than 0.6.0, consider disabling the vulnerable command line parameter until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2021-02181

CVE-2020-7924

GHSA-6CWM-WM82-HGRW

GO-2024-2550

Affected Products

Mongodb Database Tools

References · 12

• https://osv.dev/vulnerability/CVE-2020-7924 · Vendor Advisory
• https://jira.mongodb.org/browse/TOOLS-2587 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7924 · Security Note
• https://osv.dev/vulnerability/GO-2024-2550 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02181 · Security Note
• https://osv.dev/vulnerability/GHSA-6cwm-wm82-hgrw · Vendor Advisory
• https://github.com/mongodb/mongo-tools · Note
• https://github.com/mongodb/mongo-tools/commit/8c1800b5155084f954a39a1f2f259efac3bb86de · Note
• https://access.redhat.com/security/cve/cve-2020-7924 · Note
• https://t.me/cvenotify/94782 · Telegram Post
• https://github.com/advisories/GHSA-6cwm-wm82-hgrw · Note
• https://t.me/cvenotify/13112 · Telegram Post