同じ製品で同じ時期に公表された 2 件の脆弱性の 1 つです。まとめた解説: MongoDBのmacOS版で証明書検証が省略、修正版あり
Pre-authentication use-after-free in MongoDB Server replica set primary catch-up
概要
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbit...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| MongoDBMongoDB Server |
9.0.0 以上 9.0.7 未満→ 9.0.7 8.3.0 以上 8.3.16 未満→ 8.3.16 8.0.0 以上 8.0.37 未満→ 8.0.37 7.0.0 以上 7.0.48 未満→ 7.0.48 6.0.0 以上 6.0.30 未満→ 6.0.30 5.0.0 以上 5.0.35 未満→ 5.0.35 4.4.0 以上 4.4.32 未満→ 4.4.32 |
9.0.7 8.3.16 8.0.37 7.0.48 6.0.30 5.0.35 4.4.32 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.
出典: CVE.org (CVE Program・cvelistV5) NVD
参照URL
- web cna@mongodb.com
- web cna@mongodb.com