Security Bulletin: IBM Security Guardium is affected by a mongodb-driver-legacy-4.1.1.jar vulnerability (CVE-2021-20328)

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2021-20328 DESCRIPTION: MongoDB Java driver is vulnerable to a man-in-the-middle attack, caused by improper host name verification on the KMS server's certificate. An attacker could exploit this...

com.credibledoc:log-labelizer (>=1.0.40 <=1.0.51), com.github.gustavodsf:javers-persistence-mongo (>=5.15.0 <=5.16.0) +61 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-legacy (>=4.1.0 <=4.1.1)

org.mongodb:mongodb-driver-legacy MAVEN version =4.1.0, =1.0.40, =5.15.0, =5.15.0, =5.15.0, =1.5, =1.5, =1.5, =1.5, =1.2.2, =1.2.2, =1.2.3 - dev.morphia.morphia:core =1.6.1 - dev.morphia.morphia:entityscanner-plug =1.6.1 - dev.morphia.morphia:guice-plug =1.6.1 - dev.morphia.morphia:logging-slf4j...

com.coditory.sherlock:sherlock-mongo-sync (=0.4.3), com.hazelcast.jet.contrib:mongodb (=0.2) +22 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=3.11.0 <=3.11.2)

org.mongodb:mongodb-driver-sync MAVEN version =3.11.0, =0.0.1, =2.1.18, =2.1.18, =2.1.18, =2.0.0, =2.0.0, =2.0.0, =5.0.20.RC, =1.6.1, =3.11.0, =3.11.2 - org.mongojack:mongojack =2.10.1 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.0.0 <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.0.0 <=4.5.0) +67 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=3.12.0 <=3.12.7)

org.mongodb:mongodb-driver-sync MAVEN version =3.12.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1, =3.0.0-alpha-15, =3.0.0-alpha-15, =4.5.0, =5.2.1, =5.2.1, =1.1.0.20221115, =1.5.0 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

ai.platon.commons:distributed-lock-example (>=1.4.2 <=1.4.3), ai.platon.commons:distributed-lock-mongo (>=1.4.2 <=1.4.3) +280 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=4.1.0 <=4.1.1)

org.mongodb:mongodb-driver-sync MAVEN version =4.1.0, =1.4.2, =1.4.2, =1.6.6, =1.6.6, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.9.2-1 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

ai.tock:bot-test (=20.9.3), ai.tock:bot-test-base (=20.9.3) +64 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (=4.2.0)

org.mongodb:mongodb-driver-sync MAVEN version =4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.mongodb:mongodb-driver-sync and may be impacted: - ai.tock:bot-test =20.9.3 - ai.tock:bot-test-base =20.9.3 - ai.tock:bot-toolkit =20.9.3 -...

org.mongojack:mongojack (=2.10.1), org.openprovenance.prov:prov-service-translation (>=2.0.4 <=2.2.1) +6 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-legacy (=3.11.0)

org.mongodb:mongodb-driver-legacy MAVEN version =3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.mongodb:mongodb-driver-legacy and may be impacted: - org.mongojack:mongojack =2.10.1 - org.openprovenance.prov:prov-service-translation =2.0.4,...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.0.0 <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.0.0 <=4.5.0) +38 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-legacy (>=3.12.0 <=3.12.7)

org.mongodb:mongodb-driver-legacy MAVEN version =3.12.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1, =4.4.1 - com.github.rinoto.mongo:migramongo-core =1.4 - com.github.rinoto.mongo:migramongo-reflections =1.4 - com.github.rinoto.mongo:migramongo-spring =1.4 - com.github.rinoto.mongo:migramongo-spring-web =1....

com.imsweb:staging-algorithm-cs (=02.05.50.6), com.imsweb:staging-algorithm-eod-public (=2.0.7) +36 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-legacy (>=4.0.0 <=4.0.5)

org.mongodb:mongodb-driver-legacy MAVEN version =4.0.0, =5.0.5, =5.0.0, =4.0.0, =4.0.0, =1.6.0, =1.6.0, =1.6.0, =1.6.0, =2.0.0, =2.1.7 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

ai.tock:bot-test (>=20.3.0 <=20.3.3), ai.tock:bot-test-base (>=20.3.0 <=20.3.3) +269 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=4.0.0 <=4.0.5)

org.mongodb:mongodb-driver-sync MAVEN version =4.0.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.3 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

[SECURITY] Fedora 34 Update: golang-mongodb-mongo-driver-1.4.5-5.fc34

The Go driver for MongoDB...

[SECURITY] Fedora 35 Update: golang-mongodb-mongo-driver-1.4.5-5.fc35

The Go driver for MongoDB...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel-K 1.6 release and security update

A minor version update from 1.4.2 to 1.6 is now available for Red Hat Integration Camel K that includes bug fixes and enhancements. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus GA security update

Red Hat Integration Camel Extensions for Quarkus 2.2 is now GA. The purpose of this text-only errata is to inform you about the security issues fixed since the tech preview 2 release. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability...

CVE-2021-39187

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the explain option. This is due to a bug in the MongoDB Node.js driver which throws an...

CVE-2021-39187

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the explain option. This is due to a bug in the MongoDB Node.js driver which throws an...

Design/Logic Flaw

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the explain option. This is due to a bug in the MongoDB Node.js driver which throws an...

Parse Server 注入漏洞

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. An injection vulnerability exists in versions of Parse Server prior to 4.10.3, which can cause the Parse Server to crash if a query request contains an invalid value for the "explain" option. T...

PT-2021-22444 · Unknown · Parse Server +1

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.3 Description: The issue occurs when a query request contains an invalid value for the explain option, causing Parse Server to crash due to a bug in the MongoDB Node.js driver that throws an exception Parse...

PT-2021-13888 · Mongodb · Mongodb Go Driver

Name of the Vulnerable Software and Affected Versions: MongoDB Go Driver versions prior to and including 1.5.0 Description: The MongoDB Go Driver has an issue where specific cstrings input may not be properly validated when marshalling Go objects into BSON. This could allow a malicious user to...