Bug 1900849 (CVE-2019-20923)

Summary:	CVE-2019-20923 mongodb: Denial of service via unhandled Javascript exceptions
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	admiller, athomas, bkearney, clalancette, databases-maint, dbecker, gghezzo, gparvin, hhorak, jjoyce, jorton, jpacner, jramanat, jschluet, jweiser, lhh, lpeer, mburns, mskalicky, panovotn, sclewis, slinaber, stcannon, strobert, tdawson, thee
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mongodb 4.0.7, mongodb 4.1.9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-30 23:33:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1900850
Bug Blocks:	1900872

Description Pedro Sampaio 2020-11-23 20:40:41 UTC

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.7.

Upstream bug:

https://jira.mongodb.org/browse/SERVER-39481

Comment 1 Pedro Sampaio 2020-11-23 20:41:19 UTC

Created mongodb tracking bugs for this issue:

Affects: epel-all [bug 1900850]

Comment 2 Riccardo Schirone 2020-11-30 17:13:46 UTC

Upstream patch:
https://github.com/mongodb/mongo/commit/c53b2f233687487ef70398153af3d8d34bbc21d1

Comment 3 Yadnyawalk Tale 2020-11-30 17:36:41 UTC

Red Hat Satellite 6.6 onward does not ship the MongoDB package; however, the product consumes MongoDB from Red Hat Software Collections (RHSCL) for Red Hat Enterprise Linux. Satellite has no plans to update to a version of MongoDB released with a Server Side Public License (SSPL) which includes all versions released after October 16, 2018. Refer to this article for more information: https://access.redhat.com/articles/5767021

Comment 4 Product Security DevOps Team 2020-11-30 23:33:52 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-20923