Bug 1765182 (CVE-2019-2389) - CVE-2019-2389 mongodb: Incorrect scoping in shipped sysV scripts allows arbitrary PID insertion to kill
Summary: CVE-2019-2389 mongodb: Incorrect scoping in shipped sysV scripts allows arbit...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-2389
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1765183 1765184 1768411
Blocks: 1765185
TreeView+ depends on / blocked
 
Reported: 2019-10-24 13:21 UTC by Pedro Sampaio
Modified: 2021-10-25 22:12 UTC (History)
21 users (show)

Fixed In Version: mongodb 4.0.11, mongodb 3.6.14, mongodb 3.4.22, mongodb 4.1.14
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-25 22:12:56 UTC
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2019-10-24 13:21:45 UTC 
Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.11; v3.6 versions prior to 3.6.14; v3.4 versions prior to 3.4.22.

Upstream bug:

https://jira.mongodb.org/browse/SERVER-40563

Upstream patch:

https://github.com/mongodb/mongo/commit/443e8974d66a3ddd2ad89f8b3f9c2ebb7d8d9500 [master]
https://github.com/mongodb/mongo/commit/714895ea484019cf65380b94ad328e790a25e7fc [v4.0]
https://github.com/mongodb/mongo/commit/c1d1565780fa3c7fc18b591b3f1e8e0e52f3519f [v3.6]
https://github.com/mongodb/mongo/commit/e78eb1b7172aa23a7ce26bf01ccd2e8a61e31076 [v3.4]
Comment 1 Pedro Sampaio 2019-10-24 13:24:19 UTC 
Created mongodb tracking bugs for this issue:

Affects: epel-all [bug 1765183]
Affects: fedora-29 [bug 1765184]
Comment 5 Riccardo Schirone 2019-12-09 14:23:53 UTC 
Red Hat Update Infrastructure 3 is not affected by this flaw because it is now only supported on Red Hat Enterprise Linux 7, which uses systemd and was already fixed as part of CVE-2018-16888.
Comment 6 Cedric Buissart 2020-02-17 08:50:12 UTC 
Statement:

This issue affects the mongodb packages as shipped in the Red Hat Enterprise Linux version 6 release of Red Hat Software Collections. For the Red Hat Enterprise Linux version 7 release of Red Hat Software Collections, refer to systemd CVE-2018-16888.

Red Hat Satellite 6 is using MongoDB, but is not considered vulnerable because it is using the systemd service file. Please refer to CVE-2018-16888.
Note You need to log in before you can comment on or make changes to this bug.