Bug 1955780 (CVE-2021-20326)

Summary:	CVE-2021-20326 mongodb: Authorized user may trigger denial of service via find query
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	athomas, bkearney, databases-maint, gparvin, hhorak, jjoyce, jorton, jschluet, jweiser, lhh, lpeer, mburns, sclewis, slinaber, stcannon, thee, ytale
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mongodb 4.4.4, mongodb 4.9.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in MongoDB. A user authorized to performing a specific type of "find" query could use this flaw to trigger a denial of service. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1956645, 1958347
Bug Blocks:	1955781

Description Pedro Sampaio 2021-04-30 18:51:30 UTC

A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.4.

https://jira.mongodb.org/browse/SERVER-53929

Comment 2 Yadnyawalk Tale 2021-05-07 16:56:00 UTC

Upstream patch:
4.9.0: https://github.com/mongodb/mongo/commit/cd583b6c4d8aa2364f255992708b9bb54e110cf4
4.4.4: https://github.com/mongodb/mongo/commit/0c7f643a2dfe4000ac9630ed5dace0cb40ec9740