Logo
›
›vulnerability›CVE-2024-1351
Name
CVE-2024-1351
Source
NVD ( link)Debian ( link)
Description
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.
CWEs
CWE-295 CWE-295
Published Date
Updated Date
Workaround
-
Advisories
https://jira.mongodb.org/browse/SERVER-72839Issue Tracking
https://security.netapp.com/advisory/ntap-20240524-0010/Third Party Advisory
https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024Broken Link
https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024Release Notes
https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024Release Notes
https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024Release Notes
https://jira.mongodb.org/browse/SERVER-72839Issue Tracking
https://security.netapp.com/advisory/ntap-20240524-0010/Third Party Advisory
https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024Broken Link
https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024Release Notes
https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024Release Notes
https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024Release Notes

Analysis#

Affected Component
Analysis
mongodb
Exploitable

Vulnerability Ratings#

8.8
CVSSv31
9.8
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
mongodb
yocto
kirkstone
4.4.13
Exploitable
mongodb
yocto
scarthgap
4.4.30
Not Affected