Bug 1765182 (CVE-2019-2389)

Summary: CVE-2019-2389 mongodb: Incorrect scoping in shipped sysV scripts allows arbitrary PID insertion to kill
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: admiller, athomas, bkearney, clalancette, databases-maint, hhorak, hhudgeon, jjoyce, jorton, jschluet, lhh, lpeer, mburns, mskalick, panovotn, rjerrido, sclewis, slinaber, strobert, tdawson, tomm.momi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: mongodb 4.0.11, mongodb 3.6.14, mongodb 3.4.22, mongodb 4.1.14 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-25 22:12:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1765183, 1765184, 1768411    
Bug Blocks: 1765185    

Description Pedro Sampaio 2019-10-24 13:21:45 UTC 
Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.11; v3.6 versions prior to 3.6.14; v3.4 versions prior to 3.4.22.

Upstream bug:

https://jira.mongodb.org/browse/SERVER-40563

Upstream patch:

https://github.com/mongodb/mongo/commit/443e8974d66a3ddd2ad89f8b3f9c2ebb7d8d9500 [master]
https://github.com/mongodb/mongo/commit/714895ea484019cf65380b94ad328e790a25e7fc [v4.0]
https://github.com/mongodb/mongo/commit/c1d1565780fa3c7fc18b591b3f1e8e0e52f3519f [v3.6]
https://github.com/mongodb/mongo/commit/e78eb1b7172aa23a7ce26bf01ccd2e8a61e31076 [v3.4]
Comment 1 Pedro Sampaio 2019-10-24 13:24:19 UTC 
Created mongodb tracking bugs for this issue:

Affects: epel-all [bug 1765183]
Affects: fedora-29 [bug 1765184]
Comment 5 Riccardo Schirone 2019-12-09 14:23:53 UTC 
Red Hat Update Infrastructure 3 is not affected by this flaw because it is now only supported on Red Hat Enterprise Linux 7, which uses systemd and was already fixed as part of CVE-2018-16888.
Comment 6 Cedric Buissart 2020-02-17 08:50:12 UTC 
Statement:

This issue affects the mongodb packages as shipped in the Red Hat Enterprise Linux version 6 release of Red Hat Software Collections. For the Red Hat Enterprise Linux version 7 release of Red Hat Software Collections, refer to systemd CVE-2018-16888.

Red Hat Satellite 6 is using MongoDB, but is not considered vulnerable because it is using the systemd service file. Please refer to CVE-2018-16888.