Security Bulletin: IBM Cloud Private is vulnerable to a MongoDB vulnerability (CVE-2020-7921)

Summary IBM Cloud Private is vulnerable to a MongoDB vulnerability Vulnerability Details CVEID: CVE-2020-7921 DESCRIPTION: MongoDB Server could allow a remote authenticated attacker to bypass security restrictions, caused by improper serialization of internal state in the authorization subsystem...

FreeBSD : MongoDB -- Ensure RoleGraph can serialize authentication restrictions to BSON (d0be8e1f-b19a-11ea-94aa-b827eb2f57d4)

reports : Improper serialization of MongoDB Server's internal authorization state permits a user with valid credentials to bypass IP source address protection mechanisms following administrative action. Credit Discovered by Tony Yesudas. C Tenable Network Security, Inc. The descriptive text and...

MongoDB 3.6 < 3.6.18, 4.0 < 4.0.15, 4.2 < 4.2.3, 4.3 < 4.3.3 Improper Serialization Vulnerability - Windows

MongoDB is prone to an improper serialization vulnerability in the authorization subsystem. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

CVE-2020-7921 Administrative action may disable enforcement of per-user IP whitelisting

Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects MongoDB Server v4.2 versions prior to 4.2.3...

CVE-2020-7921 Administrative action may disable enforcement of per-user IP whitelisting

Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects MongoDB Server v4.2 versions prior to 4.2.3...

CVE-2020-7921

CVE-2020-7921 is an improper serialization vulnerability in MongoDB Server’s authorization subsystem that allows a privileged, authenticated user to bypass IP allowlisting after administrative action. Affected are MongoDB Server versions: 4.2 prior to 4.2.3; 4.0 prior to 4.0.15; 4.3 prior to 4.3....

CVE-2020-7921

Removed by vendor...