If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate.
This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.
References
Link | Resource |
---|---|
https://jira.mongodb.org/browse/SERVER-73662 | Issue Tracking Patch Vendor Advisory |
https://jira.mongodb.org/browse/SERVER-77028 | Issue Tracking Patch Vendor Advisory |
https://security.netapp.com/advisory/ntap-20230921-0007/ |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mongodb
Published: 2023-08-23T15:21:43.150Z
Updated: 2023-08-23T15:21:43.150Z
Reserved: 2023-03-15T10:43:39.990Z
Link: CVE-2023-1409
JSON object: View
NVD Information
Status : Modified
Published: 2023-08-23T16:15:08.167
Modified: 2023-09-21T17:15:15.390
Link: CVE-2023-1409
JSON object: View
Redhat Information
No data.
CWE