After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.9; v3.6 versions prior to 3.6.13; v3.4 versions prior to 3.4.22. References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164984
Created mongodb tracking bugs for this issue: Affects: epel-all [bug 1746133] Affects: fedora-29 [bug 1746134]
External References: https://jira.mongodb.org/browse/SERVER-38984
Mitigation: This vulnerability can be mitigated by either of two administrative practices: * Whenever a user is deleted, restart all nodes where that user may have an active session * When a user is deleted, ensure than a new user with the same name will never be created If your mongodb instance is deployed in a situation where users never need to be deleted, or one of the above mitigations can be applied, this vulnerability can not be exploited.
For this vulnerability to be exploited, an attacker must first gain access and login to a user account. While logged in, an admin must delete that account and then later remake it. Between the time it was deleted and remade, the attacker must not attempt any type of access or the token will be revoked. Once the user has been recreated, the attacker has full access to the remade account.
Upstream patches: https://github.com/mongodb/mongo/commit/e55d6e2292e5dbe2f97153251d8193d1cc89f5d7 [master] https://github.com/mongodb/mongo/commit/6dfb92b1299de04677d0bd2230e89a52eb01003c [v4.0] https://github.com/mongodb/mongo/commit/db19e7ce84cfd702a4ba9983ee2ea5019f470f82 [v3.6] https://github.com/mongodb/mongo/commit/64d8e9e1b12d16b54d6a592bae8110226c491b4e [v3.4]
Statement: This issue does affect the versions of mongodb as shipped with Red Hat Update Infrastructure for Cloud Providers, but the service is only accessible by users who already have access to the Red Hat Update Appliance (RHUA).