Vulnerability-Lookup

CVE-2021-20328 (GCVE-0-2021-20328)

Vulnerability from cvelistv5 – Published: 2021-02-25 16:30 – Updated: 2024-09-16 19:10

Title

MongoDB Java driver client-side field level encryption not verifying KMS host name

Summary

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

Severity ?

6.4 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

mongodb

References

URL

Tags

https://jira.mongodb.org/browse/JAVA-4017

x_refsource_MISC

Impacted products

Vendor

Product

Version

MongoDB Inc.

mongo-java-driver

Affected: 3.11 , ≤ 3.11.2 (custom)
Affected: 3.12 , ≤ 3.12.7 (custom)

MongoDB Inc.	mongodb-driver	Affected: 3.11 , ≤ 3.11.2 (custom) Affected: 3.12 , ≤ 3.12.7 (custom)
MongoDB Inc.	mongodb-driver-sync	Affected: 4.2.0 Affected: 3.11 , ≤ 3.11.2 (custom) Affected: 3.12 , ≤ 3.12.7 (custom) Affected: 4.0 , ≤ 4.0.5 (custom) Affected: 4.1 , ≤ 4.1.1 (custom)
MongoDB Inc.	mongodb-driver-legacy	Affected: 4.2.0 Affected: 3.11 , ≤ 3.11.2 (custom) Affected: 3.12 , ≤ 3.12.7 (custom) Affected: 4.0 , ≤ 4.0.5 (custom) Affected: 4.1 , ≤ 4.1.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:37:24.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.mongodb.org/browse/JAVA-4017"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "java_driver",
            "vendor": "mongodb",
            "versions": [
              {
                "lessThanOrEqual": "3.11.2",
                "status": "affected",
                "version": "3.11",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "3.12.7",
                "status": "affected",
                "version": "3.12",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-20328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-13T16:48:15.681647Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-15T17:36:34.465Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mongo-java-driver",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "lessThanOrEqual": "3.11.2",
              "status": "affected",
              "version": "3.11",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.12.7",
              "status": "affected",
              "version": "3.12",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "mongodb-driver",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "lessThanOrEqual": "3.11.2",
              "status": "affected",
              "version": "3.11",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.12.7",
              "status": "affected",
              "version": "3.12",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "mongodb-driver-sync",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "4.2.0"
            },
            {
              "lessThanOrEqual": "3.11.2",
              "status": "affected",
              "version": "3.11",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.12.7",
              "status": "affected",
              "version": "3.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.0.5",
              "status": "affected",
              "version": "4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.1.1",
              "status": "affected",
              "version": "4.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "mongodb-driver-legacy",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "4.2.0"
            },
            {
              "lessThanOrEqual": "3.11.2",
              "status": "affected",
              "version": "3.11",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.12.7",
              "status": "affected",
              "version": "3.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.0.5",
              "status": "affected",
              "version": "4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.1.1",
              "status": "affected",
              "version": "4.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-02-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpecific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.\u003c/p\u003e"
            }
          ],
          "value": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T13:39:14.648Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.mongodb.org/browse/JAVA-4017"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "MongoDB Java driver client-side field level encryption not verifying KMS host name",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@mongodb.com",
          "DATE_PUBLIC": "2021-02-25T17:00:00.000Z",
          "ID": "CVE-2021-20328",
          "STATE": "PUBLIC",
          "TITLE": "MongoDB Java driver client-side field level encryption not verifying KMS host name"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "mongo-java-driver",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "3.11",
                            "version_value": "3.11.2"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "3.12",
                            "version_value": "3.12.7"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "mongodb-driver",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "3.11",
                            "version_value": "3.11.2"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "3.12",
                            "version_value": "3.12.7"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "mongodb-driver-sync",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "3.11",
                            "version_value": "3.11.2"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "3.12",
                            "version_value": "3.12.7"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "4.0",
                            "version_value": "4.0.5"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "4.1",
                            "version_value": "4.1.1"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "4.2",
                            "version_value": "4.2.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "mongodb-driver-legacy",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "3.11",
                            "version_value": "3.11.2"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "3.12",
                            "version_value": "3.12.7"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "4.0",
                            "version_value": "4.0.5"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "4.1",
                            "version_value": "4.1.1"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "4.2",
                            "version_value": "4.2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "MongoDB Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-295 Improper Certificate Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.mongodb.org/browse/JAVA-4017",
              "refsource": "MISC",
              "url": "https://jira.mongodb.org/browse/JAVA-4017"
            }
          ]
        },
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2021-20328",
    "datePublished": "2021-02-25T16:30:14.536Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-09-16T19:10:28.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://jira.mongodb.org/browse/JAVA-4017\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T17:37:24.117Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-20328\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-13T16:48:15.681647Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*\"], \"vendor\": \"mongodb\", \"product\": \"java_driver\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.11\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.11.2\"}, {\"status\": \"affected\", \"version\": \"3.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.12.7\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-15T17:36:29.600Z\"}}], \"cna\": {\"title\": \"MongoDB Java driver client-side field level encryption not verifying KMS host name\", \"source\": {\"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.4, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"MongoDB Inc.\", \"product\": \"mongo-java-driver\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.11\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.11.2\"}, {\"status\": \"affected\", \"version\": \"3.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.12.7\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"MongoDB Inc.\", \"product\": \"mongodb-driver\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.11\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.11.2\"}, {\"status\": \"affected\", \"version\": \"3.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.12.7\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"MongoDB Inc.\", \"product\": \"mongodb-driver-sync\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.2.0\"}, {\"status\": \"affected\", \"version\": \"3.11\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.11.2\"}, {\"status\": \"affected\", \"version\": \"3.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.12.7\"}, {\"status\": \"affected\", \"version\": \"4.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.0.5\"}, {\"status\": \"affected\", \"version\": \"4.1\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.1.1\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"MongoDB Inc.\", \"product\": \"mongodb-driver-legacy\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.2.0\"}, {\"status\": \"affected\", \"version\": \"3.11\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.11.2\"}, {\"status\": \"affected\", \"version\": \"3.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.12.7\"}, {\"status\": \"affected\", \"version\": \"4.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.0.5\"}, {\"status\": \"affected\", \"version\": \"4.1\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.1.1\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2021-02-25T00:00:00.000Z\", \"references\": [{\"url\": \"https://jira.mongodb.org/browse/JAVA-4017\", \"tags\": [\"x_refsource_MISC\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\\u2019t use Field Level Encryption.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eSpecific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\\u2019t use Field Level Encryption.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-295\", \"description\": \"CWE-295 Improper Certificate Validation\"}]}], \"providerMetadata\": {\"orgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"shortName\": \"mongodb\", \"dateUpdated\": \"2024-02-13T13:39:14.648Z\"}, \"x_legacyV4Record\": {\"impact\": {\"cvss\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.4, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, \"source\": {\"discovery\": \"INTERNAL\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_name\": \"3.11\", \"version_value\": \"3.11.2\", \"version_affected\": \"\u003c=\"}, {\"version_name\": \"3.12\", \"version_value\": \"3.12.7\", \"version_affected\": \"\u003c=\"}]}, \"product_name\": \"mongo-java-driver\"}, {\"version\": {\"version_data\": [{\"version_name\": \"3.11\", \"version_value\": \"3.11.2\", \"version_affected\": \"\u003c=\"}, {\"version_name\": \"3.12\", \"version_value\": \"3.12.7\", \"version_affected\": \"\u003c=\"}]}, \"product_name\": \"mongodb-driver\"}, {\"version\": {\"version_data\": [{\"version_name\": \"3.11\", \"version_value\": \"3.11.2\", \"version_affected\": \"\u003c=\"}, {\"version_name\": \"3.12\", \"version_value\": \"3.12.7\", \"version_affected\": \"\u003c=\"}, {\"version_name\": \"4.0\", \"version_value\": \"4.0.5\", \"version_affected\": \"\u003c=\"}, {\"version_name\": \"4.1\", \"version_value\": \"4.1.1\", \"version_affected\": \"\u003c=\"}, {\"version_name\": \"4.2\", \"version_value\": \"4.2.0\", \"version_affected\": \"=\"}]}, \"product_name\": \"mongodb-driver-sync\"}, {\"version\": {\"version_data\": [{\"version_name\": \"3.11\", \"version_value\": \"3.11.2\", \"version_affected\": \"\u003c=\"}, {\"version_name\": \"3.12\", \"version_value\": \"3.12.7\", \"version_affected\": \"\u003c=\"}, {\"version_name\": \"4.0\", \"version_value\": \"4.0.5\", \"version_affected\": \"\u003c=\"}, {\"version_name\": \"4.1\", \"version_value\": \"4.1.1\", \"version_affected\": \"\u003c=\"}, {\"version_name\": \"4.2\", \"version_value\": \"4.2.0\", \"version_affected\": \"=\"}]}, \"product_name\": \"mongodb-driver-legacy\"}]}, \"vendor_name\": \"MongoDB Inc.\"}]}}, \"data_type\": \"CVE\", \"generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"references\": {\"reference_data\": [{\"url\": \"https://jira.mongodb.org/browse/JAVA-4017\", \"name\": \"https://jira.mongodb.org/browse/JAVA-4017\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\\u2019t use Field Level Encryption.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-295 Improper Certificate Validation\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2021-20328\", \"STATE\": \"PUBLIC\", \"TITLE\": \"MongoDB Java driver client-side field level encryption not verifying KMS host name\", \"ASSIGNER\": \"cna@mongodb.com\", \"DATE_PUBLIC\": \"2021-02-25T17:00:00.000Z\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-20328\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-16T19:10:28.653Z\", \"dateReserved\": \"2020-12-17T00:00:00\", \"assignerOrgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"datePublished\": \"2021-02-25T16:30:14.536970Z\", \"assignerShortName\": \"mongodb\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2021-20328

Vulnerability from fkie_nvd - Published: 2021-02-25 17:15 - Updated: 2024-11-21 05:46

Severity ?

6.4 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
6.8 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	cna@mongodb.com	https://jira.mongodb.org/browse/JAVA-4017	Issue Tracking, Patch, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://jira.mongodb.org/browse/JAVA-4017	Issue Tracking, Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
mongodb	java_driver	*
mongodb	java_driver	*
mongodb	java_driver	*
mongodb	java_driver	*
mongodb	java_driver	*
quarkus	quarkus	*
quarkus	quarkus	1.13.3

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
              "matchCriteriaId": "A7269E59-8D72-4459-92D0-C7B725ED290A",
              "versionEndExcluding": "3.11.3",
              "versionStartIncluding": "3.11.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
              "matchCriteriaId": "564EEC7B-9969-45F8-A358-8034DCEDCE5E",
              "versionEndExcluding": "3.12.8",
              "versionStartIncluding": "3.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
              "matchCriteriaId": "97F149A2-F169-40CB-974D-91C6AB2D49DD",
              "versionEndExcluding": "4.0.6",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
              "matchCriteriaId": "B7E4EF7D-C0F9-4B91-B7FE-5295F91AA108",
              "versionEndExcluding": "4.1.2",
              "versionStartIncluding": "4.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
              "matchCriteriaId": "482332D0-4581-459D-A187-063F5BDEA2FF",
              "versionEndExcluding": "4.2.1",
              "versionStartIncluding": "4.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA5D8178-3D1D-4AFE-80A3-7B68BF24E420",
              "versionEndExcluding": "1.13.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:quarkus:quarkus:1.13.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EEC47CA-B2E0-437D-B8BF-C0DA5713BFB1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption."
    },
    {
      "lang": "es",
      "value": "Las versiones espec\u00edficas del controlador de Java que soportan el client-side field level encryption (CSFLE) presentan un fallo al realizar una comprobaci\u00f3n correcta del nombre del host en el certificado del servidor KMS. Esta vulnerabilidad, en combinaci\u00f3n con un ataque MITM activo en una posici\u00f3n de red privilegiada, podr\u00eda resultar en una interceptaci\u00f3n del tr\u00e1fico entre el controlador de Java y el servicio KMS, haciendo que el cifrado a nivel de campo sea ineficaz. Este problema se detect\u00f3 durante las pruebas internas y afecta a todas las versiones del controlador de Java que soportan CSFLE. Los controladores Java async, Scala y flujos reactivos no est\u00e1n afectados. Esta vulnerabilidad no afecta a las cargas de tr\u00e1fico del controlador con servicios clave compatibles con CSFLE que se originan en aplicaciones que residen dentro de los tejidos de red de AWS, GCP y Azure debido a los controles de compensaci\u00f3n en estos entornos. Este problema no afecta a las cargas de trabajo de los controladores que no usan Field Level Encryption"
    }
  ],
  "id": "CVE-2021-20328",
  "lastModified": "2024-11-21T05:46:23.270",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 5.5,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2,
        "source": "cna@mongodb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-02-25T17:15:28.303",
  "references": [
    {
      "source": "cna@mongodb.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://jira.mongodb.org/browse/JAVA-4017"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://jira.mongodb.org/browse/JAVA-4017"
    }
  ],
  "sourceIdentifier": "cna@mongodb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "cna@mongodb.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GSD-2021-20328

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-20328

Aliases

CVE-2021-20328

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-20328",
    "description": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.",
    "id": "GSD-2021-20328",
    "references": [
      "https://access.redhat.com/errata/RHSA-2021:4918",
      "https://access.redhat.com/errata/RHSA-2021:4767",
      "https://access.redhat.com/errata/RHSA-2021:0871"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-20328"
      ],
      "details": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.",
      "id": "GSD-2021-20328",
      "modified": "2023-12-13T01:23:12.411692Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cna@mongodb.com",
        "ID": "CVE-2021-20328",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "mongo-java-driver",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "3.11",
                          "version_value": "3.11.2"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "3.12",
                          "version_value": "3.12.7"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "mongodb-driver",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "3.11",
                          "version_value": "3.11.2"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "3.12",
                          "version_value": "3.12.7"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "mongodb-driver-sync",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "4.2.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "3.11",
                          "version_value": "3.11.2"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "3.12",
                          "version_value": "3.12.7"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "4.0",
                          "version_value": "4.0.5"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "4.1",
                          "version_value": "4.1.1"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "mongodb-driver-legacy",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "4.2.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "3.11",
                          "version_value": "3.11.2"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "3.12",
                          "version_value": "3.12.7"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "4.0",
                          "version_value": "4.0.5"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "4.1",
                          "version_value": "4.1.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "MongoDB Inc."
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-295",
                "lang": "eng",
                "value": "CWE-295 Improper Certificate Validation"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://jira.mongodb.org/browse/JAVA-4017",
            "refsource": "MISC",
            "url": "https://jira.mongodb.org/browse/JAVA-4017"
          }
        ]
      },
      "source": {
        "discovery": "INTERNAL"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[3.11.0,3.11.2],[3.12.0,3.12.7]",
          "affected_versions": "All versions starting from 3.11.0 up to 3.11.2, all versions starting from 3.12.0 up to 3.12.7",
          "cvss_v2": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-295",
            "CWE-937"
          ],
          "date": "2022-06-22",
          "description": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.",
          "fixed_versions": [
            "3.11.3",
            "3.12.8"
          ],
          "identifier": "CVE-2021-20328",
          "identifiers": [
            "GHSA-rghw-6px2-fgwc",
            "CVE-2021-20328"
          ],
          "not_impacted": "All versions before 3.11.0, all versions after 3.11.2 before 3.12.0, all versions after 3.12.7",
          "package_slug": "maven/org.mongodb/mongo-java-driver",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.11.3, 3.12.8 or above.",
          "title": "Improper Certificate Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-20328",
            "https://jira.mongodb.org/browse/JAVA-4017",
            "https://github.com/advisories/GHSA-rghw-6px2-fgwc"
          ],
          "uuid": "1722d652-3fff-4b95-9aa4-694630ba33ec"
        },
        {
          "affected_range": "[4.0.0,4.0.5],[4.1.0,4.1.1],[3.11.0,3.11.2],[3.12.0,3.12.7],[4.2.0]",
          "affected_versions": "All versions starting from 4.0.0 up to 4.0.5, all versions starting from 4.1.0 up to 4.1.1, all versions starting from 3.11.0 up to 3.11.2, all versions starting from 3.12.0 up to 3.12.7, version 4.2.0",
          "cvss_v2": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-295",
            "CWE-937"
          ],
          "date": "2022-06-22",
          "description": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.",
          "fixed_versions": [
            "4.0.6",
            "4.1.2",
            "3.11.3",
            "4.2.1"
          ],
          "identifier": "CVE-2021-20328",
          "identifiers": [
            "GHSA-rghw-6px2-fgwc",
            "CVE-2021-20328"
          ],
          "not_impacted": "All versions before 4.0.0, all versions after 4.0.5 before 4.1.0, all versions after 4.1.1, all versions before 3.11.0, all versions after 3.11.2 before 3.12.0, all versions after 3.12.7 before 4.2.0, all versions after 4.2.0",
          "package_slug": "maven/org.mongodb/mongodb-driver-legacy",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 4.0.6, 4.1.2, 3.11.3, 4.2.1 or above.",
          "title": "Improper Certificate Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-20328",
            "https://jira.mongodb.org/browse/JAVA-4017",
            "https://github.com/advisories/GHSA-rghw-6px2-fgwc"
          ],
          "uuid": "ae06a90e-5dbc-414f-a1bb-1ed963b455b4"
        },
        {
          "affected_range": "[4.0.0,4.0.5],[4.1.0,4.1.1],[3.12.0,3.12.7],[4.2.0],[3.11.0,3.11.2]",
          "affected_versions": "All versions starting from 4.0.0 up to 4.0.5, all versions starting from 4.1.0 up to 4.1.1, all versions starting from 3.12.0 up to 3.12.7, version 4.2.0, all versions starting from 3.11.0 up to 3.11.2",
          "cvss_v2": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-295",
            "CWE-937"
          ],
          "date": "2022-06-22",
          "description": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.",
          "fixed_versions": [
            "4.0.6",
            "4.1.2",
            "4.2.1",
            "3.11.3"
          ],
          "identifier": "CVE-2021-20328",
          "identifiers": [
            "GHSA-rghw-6px2-fgwc",
            "CVE-2021-20328"
          ],
          "not_impacted": "All versions before 4.0.0, all versions after 4.0.5 before 4.1.0, all versions after 4.1.1, all versions before 3.12.0, all versions after 3.12.7 before 4.2.0, all versions after 4.2.0, all versions before 3.11.0, all versions after 3.11.2",
          "package_slug": "maven/org.mongodb/mongodb-driver-sync",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 4.0.6, 4.1.2, 4.2.1, 3.11.3 or above.",
          "title": "Improper Certificate Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-20328",
            "https://jira.mongodb.org/browse/JAVA-4017",
            "https://github.com/advisories/GHSA-rghw-6px2-fgwc"
          ],
          "uuid": "2afcdce6-f4b4-431c-94ae-813b12e4eb99"
        },
        {
          "affected_range": "[3.11.0,3.11.2],[3.12.0,3.12.7]",
          "affected_versions": "All versions starting from 3.11.0 up to 3.11.2, all versions starting from 3.12.0 up to 3.12.7",
          "cvss_v2": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-295",
            "CWE-937"
          ],
          "date": "2022-06-22",
          "description": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.",
          "fixed_versions": [
            "3.11.3",
            "3.12.8"
          ],
          "identifier": "CVE-2021-20328",
          "identifiers": [
            "GHSA-rghw-6px2-fgwc",
            "CVE-2021-20328"
          ],
          "not_impacted": "All versions before 3.11.0, all versions after 3.11.2 before 3.12.0, all versions after 3.12.7",
          "package_slug": "maven/org.mongodb/mongodb-driver",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.11.3, 3.12.8 or above.",
          "title": "Improper Certificate Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-20328",
            "https://jira.mongodb.org/browse/JAVA-4017",
            "https://github.com/advisories/GHSA-rghw-6px2-fgwc"
          ],
          "uuid": "42adf305-29e0-4249-93e2-2319cddd8a5c"
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
                    "matchCriteriaId": "A7269E59-8D72-4459-92D0-C7B725ED290A",
                    "versionEndExcluding": "3.11.3",
                    "versionStartIncluding": "3.11.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
                    "matchCriteriaId": "564EEC7B-9969-45F8-A358-8034DCEDCE5E",
                    "versionEndExcluding": "3.12.8",
                    "versionStartIncluding": "3.12.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
                    "matchCriteriaId": "97F149A2-F169-40CB-974D-91C6AB2D49DD",
                    "versionEndExcluding": "4.0.6",
                    "versionStartIncluding": "4.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
                    "matchCriteriaId": "B7E4EF7D-C0F9-4B91-B7FE-5295F91AA108",
                    "versionEndExcluding": "4.1.2",
                    "versionStartIncluding": "4.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
                    "matchCriteriaId": "482332D0-4581-459D-A187-063F5BDEA2FF",
                    "versionEndExcluding": "4.2.1",
                    "versionStartIncluding": "4.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DA5D8178-3D1D-4AFE-80A3-7B68BF24E420",
                    "versionEndExcluding": "1.13.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:quarkus:quarkus:1.13.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9EEC47CA-B2E0-437D-B8BF-C0DA5713BFB1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.\n\n"
          },
          {
            "lang": "es",
            "value": "Las versiones espec\u00edficas del controlador de Java que soportan el client-side field level encryption (CSFLE) presentan un fallo al realizar una comprobaci\u00f3n correcta del nombre del host en el certificado del servidor KMS. Esta vulnerabilidad, en combinaci\u00f3n con un ataque MITM activo en una posici\u00f3n de red privilegiada, podr\u00eda resultar en una interceptaci\u00f3n del tr\u00e1fico entre el controlador de Java y el servicio KMS, haciendo que el cifrado a nivel de campo sea ineficaz. Este problema se detect\u00f3 durante las pruebas internas y afecta a todas las versiones del controlador de Java que soportan CSFLE. Los controladores Java async, Scala y flujos reactivos no est\u00e1n afectados. Esta vulnerabilidad no afecta a las cargas de tr\u00e1fico del controlador con servicios clave compatibles con CSFLE que se originan en aplicaciones que residen dentro de los tejidos de red de AWS, GCP y Azure debido a los controles de compensaci\u00f3n en estos entornos. Este problema no afecta a las cargas de trabajo de los controladores que no usan Field Level Encryption"
          }
        ],
        "id": "CVE-2021-20328",
        "lastModified": "2024-02-13T14:15:45.110",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "ADJACENT_NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 5.5,
              "impactScore": 4.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 5.2,
              "source": "cna@mongodb.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2021-02-25T17:15:28.303",
        "references": [
          {
            "source": "cna@mongodb.com",
            "tags": [
              "Issue Tracking",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://jira.mongodb.org/browse/JAVA-4017"
          }
        ],
        "sourceIdentifier": "cna@mongodb.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-295"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-295"
              }
            ],
            "source": "cna@mongodb.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

GHSA-RGHW-6PX2-FGWC

Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2024-02-13 19:27

Summary

Improper Certificate Validation in MongoDB

Details

Severity ?

6.8 (Medium)


                  
                    CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.11.0"
            },
            {
              "fixed": "3.11.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.12.7"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.12.0"
            },
            {
              "fixed": "3.12.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.0.5"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver-sync"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver-sync"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver-sync"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0"
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongo-java-driver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.11.0"
            },
            {
              "fixed": "3.11.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.12.7"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongo-java-driver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.12.0"
            },
            {
              "fixed": "3.12.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.0.5"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver-legacy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver-legacy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver-legacy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.11.0"
            },
            {
              "fixed": "3.11.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.12.7"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver-legacy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.12.0"
            },
            {
              "fixed": "3.12.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.12.7"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver-sync"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.12.0"
            },
            {
              "fixed": "3.12.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver-sync"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.11.0"
            },
            {
              "fixed": "3.11.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mongodb:mongodb-driver-legacy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-20328"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-22T18:49:12Z",
    "nvd_published_at": "2021-02-25T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.",
  "id": "GHSA-rghw-6px2-fgwc",
  "modified": "2024-02-13T19:27:59Z",
  "published": "2022-05-24T22:28:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20328"
    },
    {
      "type": "WEB",
      "url": "https://jira.mongodb.org/browse/JAVA-4017"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Certificate Validation in MongoDB"
}

CERTFR-2021-AVI-151

Vulnerability from certfr_avis - Published: 2021-03-01 - Updated: 2021-03-01

De multiples vulnérabilités ont été découvertes dans mongoDB et mongoDB Ops Manager. Elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
MongoDB	N/A	module mongodb-client-encryption 1.2.0
MongoDB	N/A	pilotes mongo-java-driver, mongodb-driver, mongodb-driver-sync, mongodb-driver-legacy versions 3.12.x antérieures à 3.12.8
MongoDB	N/A	pilotes mongodb-driver-sync, mongodb-driver-legacy versions 4.1.x antérieures à 4.1.2
MongoDB	N/A	pilotes mongodb-driver-sync, mongodb-driver-legacy versions 4.2.x antérieures à 4.2.1
MongoDB	N/A	pilotes mongo-java-driver, mongodb-driver, mongodb-driver-sync, mongodb-driver-legacy versions 3.11.x antérieures à 3.11.3
MongoDB	N/A	mongoDB Ops Manager versions 4.2.x antérieures à 4.2.23
MongoDB	N/A	pilotes mongodb-driver-sync, mongodb-driver-legacy versions 4.0.x antérieures à 4.0.6

References

Title

Publication Time

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2021-20328 (GCVE-0-2021-20328)

FKIE_CVE-2021-20328

GSD-2021-20328

GHSA-RGHW-6PX2-FGWC

CERTFR-2021-AVI-151

Solution

Tags

Sightings

Nomenclature