CVE-2023-1409
published 2023-08-23CVE-2023-1409: If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.36%
28.3th percentile
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate.
This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | >= 0 < 6.1.53 | 6.1.53 |
| linux | linux_kernel | >= 6.2.0 < 6.4.16 | 6.4.16 |
| linux | linux_kernel | >= 6.3.0 < 6.5.3 | 6.5.3 |
| mongodb | mongodb | >= 4.4.0 < 4.4.23 | 4.4.23 |
| mongodb | mongodb | 5.0.0 – 5.0.14 | — |
| mongodb | mongodb | >= 6.0.0 < 6.0.7 | 6.0.7 |
| mongodb | mongodb | 6.3.0 – 6.3.2 | — |
| mongodb_inc | mongodb_server | 4.4 – 4.4.23 | — |
| mongodb_inc | mongodb_server | 5.0 – 5.0.14 | — |
| mongodb_inc | mongodb_server | 6.3 – 6.3.2 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
osv7.5HIGH
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Revert "f2fs: fix to do sanity check on extent cache correctly"
osv·2025-12-08
CVE-2023-53763 Revert "f2fs: fix to do sanity check on extent cache correctly"
Revert "f2fs: fix to do sanity check on extent cache correctly"
In the Linux kernel, the following vulnerability has been resolved:
Revert "f2fs: fix to do sanity check on extent cache correctly"
syzbot reports a f2fs bug as below:
UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19
index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]')
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:217 [inline]
__ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
inline_data_addr fs/f2fs/f2fs.h:3275 [inline]
__recover_inline_status fs/f2fs/inode.c:113 [inline]
do_read_inode fs/f2fs/inode.c:480 [inline]
f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604
f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.
GHSA
GHSA-pjfq-h6gx-wrcf: If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work
ghsa_unreviewed·2023-08-23
CVE-2023-1409 [HIGH] CWE-295 GHSA-pjfq-h6gx-wrcf: If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate.
This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.
OSV
CVE-2023-1409: If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work
osv·2023-08-23·CVSS 7.5
CVE-2023-1409 [HIGH] CVE-2023-1409: If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.
Red Hat
kernel: Revert "f2fs: fix to do sanity check on extent cache correctly"
vendor_redhat·2025-12-08·CVSS 3.3
CVE-2023-53763 [LOW] CWE-783 kernel: Revert "f2fs: fix to do sanity check on extent cache correctly"
kernel: Revert "f2fs: fix to do sanity check on extent cache correctly"
In the Linux kernel, the following vulnerability has been resolved:
Revert "f2fs: fix to do sanity check on extent cache correctly"
syzbot reports a f2fs bug as below:
UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19
index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]')
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:217 [inline]
__ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
inline_data_addr fs/f2fs/f2fs.h:3275 [inline]
__recover_inline_status fs/f2fs/inode.c:113 [inline]
do_read_inode fs/f2fs/inode.c:480 [inline]
f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604
f2fs_fill_super+0x640e/0x80c0 fs/f2fs/s
No detection rules found.
No public exploits indexed.
2023-08-23
Published