CVE-2024-3374 — Reachable Assertion in INC Mongodb Server

CWE-617 — Reachable Assertion6 documents6 sources
Severity
5.3MEDIUMNVD
EPSS
0.6%
top 30.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mongodb INC Mongodb ServerMongodb
Timeline
PublishedMay 14

Description

An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5mongodb_inc/mongodb_server5.0 — 5.0.16+1
▶NVDmongodb/mongodb5.0.0 — 5.0.16+1

🔴Vulnerability Details

3
OSV
CVE-2024-3374: An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object↗2024-05-14
▶
GHSA
GHSA-8j48-r5wc-gvr3: An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object↗2024-05-14
▶
CVEList
MongoDB Server (mongod) may crash when generating ftdc↗2024-05-14
▶

📋Vendor Advisories

1
Red Hat
mongodb: trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes↗2024-05-14
▶

💬Community

1
Bugzilla
CVE-2024-26927 kernel: ASoC: SOF: Add some bounds checking to firmware data↗2024-04-29
▶
CVE-2024-3374 — Reachable Assertion | cvebase