CVE-2021-32037 — Reachable Assertion in INC Mongodb Server

CWE-617 — Reachable Assertion5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 35.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mongodb INC Mongodb ServerMongodb
Timeline
PublishedNov 24
Latest updateMay 24

Description

An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shards of an auth enabled environment. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5mongodb_inc/mongodb_server5.0 — 5.0.2
▶NVDmongodb/mongodb5.0.0 — 5.0.2

🔴Vulnerability Details

3
GHSA
GHSA-8v5c-chfg-fcjx: An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard↗2022-05-24
▶
OSV
CVE-2021-32037: An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard↗2021-11-24
▶
CVEList
User may trigger invariant when allowed to send commands directly to shards↗2021-11-24
▶

📋Vendor Advisories

1
Red Hat
mongodb: Using $sample can trigger invariant when connecting directly to shards↗2021-11-24
▶
CVE-2021-32037 — Reachable Assertion | cvebase