GitHub Advisoryadvisory · Go

GHSA-6cwm-wm82-hgrw MongoDB Tools Improper Certificate Validation vulnerability

MEDIUM Published 2022-05-24 Modified 2024-07-03 Official page ↗
Aliases
CVE-2020-7924
Ecosystem
Go
Packages
github.com/mongodb/mongo-tools
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-295
Reviewed
2024-02-13

Affected packages

• Go github.com/mongodb/mongo-tools: >= 100.0.0, < 100.2.0 → fixed in 100.2.0

Description

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0.

Related

Alias · CVE (1)

  • CVE-2020-7924 Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References