Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2238
MongoDB -- Ensure RoleGraph can serialize authentication
restrictions to BSON
30 June 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: MongoDB
Publisher: FreeBSD
Operating System: FreeBSD
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Unauthorised Access -- Existing Account
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-7921
Original Bulletin:
http://www.vuxml.org/freebsd/d0be8e1f-b19a-11ea-94aa-b827eb2f57d4.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than FreeBSD. It is recommended that administrators
running MongoDB check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
MongoDB -- Ensure RoleGraph can serialize authentication restrictions to BSON
Affected packages
mongodb36 < 3.6.18
mongodb40 < 4.0.15
mongodb42 < 4.2.3
Details
VuXML ID d0be8e1f-b19a-11ea-94aa-b827eb2f57d4
Discovery 2020-01-10
Entry 2020-06-29
reports:
Improper serialization of MongoDB Server's internal authorization state
permits a user with valid credentials to bypass IP source address
protection mechanisms following administrative action.
Credit
Discovered by Tony Yesudas.
https://jira.mongodb.org/browse/SERVER-45472
References
CVE Name CVE-2020-7921
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXvqM1uNLKJtyKPYoAQgQ6g/+O88H+ZnjXsDn3G0KNnZIeJlysQw9qalj
vRj/hOnJUB8bIANJV4F0Ou66jxZ2D0CUsTv/XfB06k+k9wZFMCFEucNmvxu+6cis
V3W5gseHEChekACzjlXNX+jfnEeXBrNBPiLg7jSffThMi2Oi5NUQeh9ZOFTYqmlI
CppcjZTbhGcELhlbsVXIQ7SIQ+BtPdmF/rYI52xzsDdGayTLmxurjwd9GHGWuO8z
3yClk3/QqK4UqmL0aMz0GAfwSP1+6wjtKrh8A73CNh5t1FioSl3FPZkYtEnI79Zf
libXZn7I34qP0EOF9siYPvEes/6MQ+CcUqNeNv7Mky724oTnQp/oqXAqY6tp9WDZ
BaRdR6SdK6ud4MnRciknMxHaTA0Z2Tg/sjAQTxqq03oeuJB9lRiWFwrqiaxnvqVe
Co2i//3qF9HmVUf84Tdtm/CGZY/T4/c2MIBs6ZYzIzZG3p1tzsXwNER6kwkydEa0
PjihOmiI2glD32nciuHQIo6mDlNOr4SaoS4oZ76C+njL88V5LN3DK0rH8BCo3jwl
FlmBSOFr1VBDy2khMzgZjjqd6g8wYY8PZqXCwUlvIgSko+EtaB93fRbB8OrID+5M
4IQIrh8m9EXSYaqaav+2s0RMzhltPej8cGmeDzKybtu1xDV7lpwYEveQeCBYEgwG
G0oLWU8fIlw=
=oePJ
-----END PGP SIGNATURE-----