Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mongo-java-driver-3.10.1.jar: 1 vulnerabilities (highest severity is: 6.8) #27

Open
mend-bolt-for-github bot opened this issue May 5, 2022 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource

Comments

@mend-bolt-for-github
Copy link

mend-bolt-for-github bot commented May 5, 2022

Vulnerable Library - mongo-java-driver-3.10.1.jar

The MongoDB Java Driver uber-artifact, containing the legacy driver, the mongodb-driver, mongodb-driver-core, and bson

Library home page: http://www.mongodb.org

Path to dependency file: /build.gradle

Path to vulnerable library: /canner/.gradle/caches/modules-2/files-2.1/org.mongodb/mongo-java-driver/3.10.1/d2a7008196b34b735cfc47d8609ebe47f62cd8a1/mongo-java-driver-3.10.1.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (mongo-java-driver version) Remediation Possible**
CVE-2021-20328 Medium 6.8 mongo-java-driver-3.10.1.jar Direct 3.11.3

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-20328

Vulnerable Library - mongo-java-driver-3.10.1.jar

The MongoDB Java Driver uber-artifact, containing the legacy driver, the mongodb-driver, mongodb-driver-core, and bson

Library home page: http://www.mongodb.org

Path to dependency file: /build.gradle

Path to vulnerable library: /canner/.gradle/caches/modules-2/files-2.1/org.mongodb/mongo-java-driver/3.10.1/d2a7008196b34b735cfc47d8609ebe47f62cd8a1/mongo-java-driver-3.10.1.jar

Dependency Hierarchy:

  • mongo-java-driver-3.10.1.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

Publish Date: 2021-02-25

URL: CVE-2021-20328

CVSS 3 Score Details (6.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rghw-6px2-fgwc

Release Date: 2021-02-25

Fix Resolution: 3.11.3

Step up your Open Source Security Game with Mend here

@mend-bolt-for-github mend-bolt-for-github bot added the Mend: dependency security vulnerability Security vulnerability detected by WhiteSource label May 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource
Projects
None yet
Development

No branches or pull requests

0 participants