Skip to content
CVE PROGRAM SOURCE RECORD4.2 Medium

CVE-2020-7924

Specific command line parameter might result in accepting invalid certificate

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Inc. MongoDB Database Tools

Default version status: unaffected

  • 3.6.5 to ≤ 3.6.21affected
  • 4.0 to < 4.0.21affected
  • 4.2 to < 4.2.11affected
  • 100 to < 100.2.0affected

MongoDB Inc. Mongomirror

Default version status: unaffected

  • 0.6.0 to < 0*affected

References