MongoDBのmacOS版で証明書検証が省略、修正版あり
Summary
macOS上のMongoDB ServerがIPv6の相手とTLSで接続するとき、証明書の検証が働かず、通信を盗み見られたり書き換えられたりするおそれがあります。macOSでMongoDBを動かしている組織は、修正版への更新と、IPv6で接続する構成があるかの確認を進めてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
macOS上のMongoDB ServerがIPv6の相手とTLSで接続するとき、証明書の検証が働かず、通信を盗み見られたり書き換えられたりするおそれがあります。macOSでMongoDBを動かしている組織は、修正版への更新と、IPv6で接続する構成があるかの確認を進めてください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| MongoDBMongoDB Server |
≥ 9.0.0, < 9.0.7→ 9.0.7 ≥ 8.3.0, < 8.3.16→ 8.3.16 ≥ 8.0.0, < 8.0.37→ 8.0.37 ≥ 7.0.0, < 7.0.48→ 7.0.48 |
9.0.7 8.3.16 8.0.37 7.0.48 |
Original description The description as published by the source.
An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic. This issue only affects MongoDB processes running on macOS with the Apple SecureTransport TLS provider.
Source: CVE.org (CVE Program・cvelistV5) NVD
References
- web cna@mongodb.com