Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.mongodb:mongodb-driver-legacy

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.8MavenPublished

    Improper Certificate Validation in MongoDB

    CVE-2021-20328 · GHSA-rghw-6px2-fgwc

    Affected
    • Maven org.mongodb:mongodb-driver-legacy >= 4.0.0, <= 4.0.5; >= 4.1.0, <= 4.1.1; >= 3.11.0, <= 3.11.2; >= 3.12.0, <= 3.12.7; >= 4.2.0, <= 4.2.0
    Fixed in
    4.2.14.1.23.12.84.0.63.11.3· Vendor fix available
    Issue
    Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

    Recommended action: Upgrade to 4.2.1, 4.1.2, 4.0.6 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →