IBM Cloud Private is vulnerable to a MongoDB vulnerability
CVEID:CVE-2020-7921
**DESCRIPTION:**MongoDB Server could allow a remote authenticated attacker to bypass security restrictions, caused by improper serialization of internal state in the authorization subsystem. An attacker could exploit this vulnerability to bypass IP allowlisting protection.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/181688 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM Cloud Private | 3.2.1 CD |
IBM Cloud Private | 3.2.2 CD |
Product defect fixes and security updates are only available for the two most recent Continuous Delivery (CD) update packages
For IBM Cloud Private 3.2.1, apply Aug fix pack:
For IBM Cloud Private 3.2.2, apply Aug fix pack:
For IBM Cloud Private 3.1.0, 3.1.1, 3.1.2, 3.2.0:
Upgrade to the latest Continuous Delivery (CD) update package, IBM Cloud Private 3.2.2.2008.
If required, individual product fixes can be made available between CD update packages for resolution of problems. Contact IBM support for assistance
None