An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Mongodb | — | Upgrade MongoDB to version 3.6.15Upgrade MongoDB to version 4.2.1Upgrade to the latest version of MongoDBUpgrade MongoDB to version 4.0.13Upgrade MongoDB to version 3.4.24 | Dec 7, 2020 | Nov 24, 2020 |
| Ubuntu | — | Upgrade mongodb-server-coreUpgrade mongodbUpgrade mongodb-clientsUpgrade mongodb-server | Oct 5, 2021 | Nov 24, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub