Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2019-2389

Process termination via PID file manipulation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Inc. MongoDB Server

Default version status: unaffected

  • 4.0 to < 4.0.11affected
  • 3.6 to < 3.6.14affected
  • 3.4 to < 3.4.22affected

References