GHSA-rghw-6px2-fgwc

Suggest an improvement
Source
https://github.com/advisories/GHSA-rghw-6px2-fgwc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rghw-6px2-fgwc/GHSA-rghw-6px2-fgwc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-rghw-6px2-fgwc
Aliases
Published
2022-05-24T22:28:56Z
Modified
2024-02-16T08:11:17.848383Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Improper Certificate Validation in MongoDB
Details

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

Database specific 
{
    "nvd_published_at": "2021-02-25T17:15:00Z",
    "cwe_ids": [
        "CWE-295"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-22T18:49:12Z"
}
References

Affected packages

Maven / org.mongodb:mongodb-driver

Package

Name
org.mongodb:mongodb-driver
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.11.0
Fixed
3.11.3

Affected versions

3.*

3.11.0
3.11.1
3.11.2

Database specific 

{
    "last_known_affected_version_range": "<= 3.11.2"
}

Maven / org.mongodb:mongodb-driver

Package

Name
org.mongodb:mongodb-driver
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.12.0
Fixed
3.12.8

Affected versions

3.*

3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7

Database specific 

{
    "last_known_affected_version_range": "<= 3.12.7"
}

Maven / org.mongodb:mongodb-driver-sync

Package

Name
org.mongodb:mongodb-driver-sync
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver-sync

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.0.6

Affected versions

4.*

4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5

Database specific 

{
    "last_known_affected_version_range": "<= 4.0.5"
}

Maven / org.mongodb:mongodb-driver-sync

Package

Name
org.mongodb:mongodb-driver-sync
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver-sync

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.0
Fixed
4.1.2

Affected versions

4.*

4.1.0
4.1.1

Database specific 

{
    "last_known_affected_version_range": "<= 4.1.1"
}

Maven / org.mongodb:mongodb-driver-sync

Package

Name
org.mongodb:mongodb-driver-sync
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver-sync

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Fixed
4.2.1

Affected versions

4.*

4.2.0

Maven / org.mongodb:mongo-java-driver

Package

Name
org.mongodb:mongo-java-driver
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongo-java-driver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.11.0
Fixed
3.11.3

Affected versions

3.*

3.11.0
3.11.1
3.11.2

Database specific 

{
    "last_known_affected_version_range": "<= 3.11.2"
}

Maven / org.mongodb:mongo-java-driver

Package

Name
org.mongodb:mongo-java-driver
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongo-java-driver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.12.0
Fixed
3.12.8

Affected versions

3.*

3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7

Database specific 

{
    "last_known_affected_version_range": "<= 3.12.7"
}

Maven / org.mongodb:mongodb-driver-legacy

Package

Name
org.mongodb:mongodb-driver-legacy
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver-legacy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.0.6

Affected versions

4.*

4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5

Database specific 

{
    "last_known_affected_version_range": "<= 4.0.5"
}

Maven / org.mongodb:mongodb-driver-legacy

Package

Name
org.mongodb:mongodb-driver-legacy
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver-legacy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.0
Fixed
4.1.2

Affected versions

4.*

4.1.0
4.1.1

Database specific 

{
    "last_known_affected_version_range": "<= 4.1.1"
}

Maven / org.mongodb:mongodb-driver-legacy

Package

Name
org.mongodb:mongodb-driver-legacy
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver-legacy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.11.0
Fixed
3.11.3

Affected versions

3.*

3.11.0
3.11.1
3.11.2

Database specific 

{
    "last_known_affected_version_range": "<= 3.11.2"
}

Maven / org.mongodb:mongodb-driver-legacy

Package

Name
org.mongodb:mongodb-driver-legacy
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver-legacy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.12.0
Fixed
3.12.8

Affected versions

3.*

3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7

Database specific 

{
    "last_known_affected_version_range": "<= 3.12.7"
}

Maven / org.mongodb:mongodb-driver-sync

Package

Name
org.mongodb:mongodb-driver-sync
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver-sync

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.12.0
Fixed
3.12.8

Affected versions

3.*

3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7

Database specific 

{
    "last_known_affected_version_range": "<= 3.12.7"
}

Maven / org.mongodb:mongodb-driver-sync

Package

Name
org.mongodb:mongodb-driver-sync
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver-sync

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.11.0
Fixed
3.11.3

Affected versions

3.*

3.11.0
3.11.1
3.11.2

Database specific 

{
    "last_known_affected_version_range": "<= 3.11.2"
}

Maven / org.mongodb:mongodb-driver-legacy

Package

Name
org.mongodb:mongodb-driver-legacy
View open source insights on deps.dev
Purl
pkg:maven/org.mongodb/mongodb-driver-legacy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Fixed
4.2.1

Affected versions

4.*

4.2.0