Lucene search

GoogleOSV:BIT-MONGODB-2021-20330

HistoryMar 06, 2024 - 10:58 a.m.

BIT-mongodb-2021-20330

2024-03-0610:58:03

Google

osv.dev

attacker

replicated collection

applyops command

denial of service

mongodb server

versions

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.3%

JSON

An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.

CPENameOperatorVersion
mongodbge4.0.0
mongodbge4.2.0
mongodbge4.4.0
mongodblt4.2.14
mongodblt4.4.6
mongodblt4.0.25

Name	Operator	Version
mongodb	ge	4.0.0
mongodb	ge	4.2.0
mongodb	ge	4.4.0
mongodb	lt	4.2.14
mongodb	lt	4.4.6
mongodb	lt	4.0.25

References

jira.mongodb.org/browse/SERVER-36263