MongoDB Serverの集計処理で脆弱性、認証済みユーザーに情報漏えいのおそれ
Summary
認証済みのユーザーが1つの集計リクエストを送るだけで、解放済みのプロセスメモリの内容が返され、情報が漏えいするおそれがあります。影響するのは8.3.0以上8.3.16未満、8.0.0以上8.0.37未満、7.0.0以上7.0.48未満のMongoDB Serverです。修正版の8.3.16、8.0.37、7.0.48への更新が必要です。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
認証済みのユーザーが1つの集計リクエストを送るだけで、解放済みのプロセスメモリの内容が返され、情報が漏えいするおそれがあります。影響するのは8.3.0以上8.3.16未満、8.0.0以上8.0.37未満、7.0.0以上7.0.48未満のMongoDB Serverです。修正版の8.3.16、8.0.37、7.0.48への更新が必要です。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| MongoDBMongoDB Server |
≥ 8.3.0, < 8.3.16→ 8.3.16 ≥ 8.0.0, < 8.0.37→ 8.0.37 ≥ 7.0.0, < 7.0.48→ 7.0.48 |
8.3.16 8.0.37 7.0.48 |
Original description The description as published by the source.
A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server availability.
Source: CVE.org (CVE Program・cvelistV5) NVD
References
- web cna@mongodb.com