CVE-2024-1351
published 2024-03-07CVE-2024-1351: Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.50%
39.6th percentile
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28.
Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 4.4.0 < 4.4.29 | 4.4.29 |
| mongodb | mongodb | >= 5.0.0 < 5.0.25 | 5.0.25 |
| mongodb | mongodb | >= 6.0.0 < 6.0.14 | 6.0.14 |
| mongodb | mongodb | >= 7.0.0 < 7.0.6 | 7.0.6 |
| mongodb_inc | mongodb_server | 4.4 – 4.4.28 | — |
| mongodb_inc | mongodb_server | 5.0 – 5.0.24 | — |
| mongodb_inc | mongodb_server | 6.0 – 6.0.13 | — |
| mongodb_inc | mongodb_server | 7.0 – 7.0.5 | — |
| netapp | ontap_tools | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-825c-4w2m-h7fv: Under certain configurations of --tlsCAFile and tls
ghsa_unreviewed·2024-03-07
CVE-2024-1351 [HIGH] CWE-295 GHSA-825c-4w2m-h7fv: Under certain configurations of --tlsCAFile and tls
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28.
Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTL
OSV
CVE-2024-1351: Under certain configurations of --tlsCAFile and tls
osv·2024-03-07·CVSS 9.8
CVE-2024-1351 [CRITICAL] CVE-2024-1351: Under certain configurations of --tlsCAFile and tls
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS
Red Hat
kernel: Bluetooth: ISO: Check socket flag instead of hcon
vendor_redhat·2024-07-30·CVSS 5.5
CVE-2024-42141 [MEDIUM] kernel: Bluetooth: ISO: Check socket flag instead of hcon
kernel: Bluetooth: ISO: Check socket flag instead of hcon
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Check socket flag instead of hcon
This fixes the following Smatch static checker warning:
net/bluetooth/iso.c:1364 iso_sock_recvmsg()
error: we previously assumed 'pi->conn->hcon' could be null (line 1359)
net/bluetooth/iso.c
1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1348 size_t len, int flags)
1349 {
1350 struct sock *sk = sock->sk;
1351 struct iso_pinfo *pi = iso_pi(sk);
1352
1353 BT_DBG("sk %p", sk);
1354
1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP,
&bt_sk(sk)->flags)) {
1356 lock_sock(sk);
1357 switch (sk->sk_state) {
1358 case BT_CONNECT2:
1359 if (pi->conn->hcon &&
^^^^^^^^^^^^^^ If ->hcon is NULL
1360 test_bi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://jira.mongodb.org/browse/SERVER-72839https://security.netapp.com/advisory/ntap-20240524-0010/https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024https://jira.mongodb.org/browse/SERVER-72839https://security.netapp.com/advisory/ntap-20240524-0010/https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024
2024-03-07
Published