Lucene search

[email protected]CVE-2021-20328

HistoryFeb 25, 2021 - 5:15 p.m.

CVE-2021-20328

2021-02-2517:15:28

CWE-295

[email protected]

web.nvd.nist.gov

cve-2021-20328

java driver

host name verification

kms server

certificate

mitm attack

interception

traffic

field level encryption

csfle

aws

gcp

azure

network security

4.3 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:M/Au:N/C:P/I:P/A:N

6.8 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

6.2 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

JSON

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

Affected configurations

NVD

Node

mongodbjava_driverRange3.11.0–3.11.3mongodb

mongodbjava_driverRange3.12.0–3.12.8mongodb

mongodbjava_driverRange4.0.0–4.0.6mongodb

mongodbjava_driverRange4.1.0–4.1.2mongodb

mongodbjava_driverRange4.2.0–4.2.1mongodb

Node

quarkusquarkusRange<1.13.3

quarkusquarkusMatch1.13.3

CPENameOperatorVersion
mongodb:java_drivermongodb java driverlt3.11.3
mongodb:java_drivermongodb java driverlt3.12.8
mongodb:java_drivermongodb java driverlt4.0.6
mongodb:java_drivermongodb java driverlt4.1.2
mongodb:java_drivermongodb java driverlt4.2.1

CPE	Name	Operator	Version
mongodb:java_driver	mongodb java driver	lt	3.11.3
mongodb:java_driver	mongodb java driver	lt	3.12.8
mongodb:java_driver	mongodb java driver	lt	4.0.6
mongodb:java_driver	mongodb java driver	lt	4.1.2
mongodb:java_driver	mongodb java driver	lt	4.2.1

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "mongo-java-driver",
    "vendor": "MongoDB Inc.",
    "versions": [
      {
        "lessThanOrEqual": "3.11.2",
        "status": "affected",
        "version": "3.11",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.12.7",
        "status": "affected",
        "version": "3.12",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "mongodb-driver",
    "vendor": "MongoDB Inc.",
    "versions": [
      {
        "lessThanOrEqual": "3.11.2",
        "status": "affected",
        "version": "3.11",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.12.7",
        "status": "affected",
        "version": "3.12",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "mongodb-driver-sync",
    "vendor": "MongoDB Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "4.2.0"
      },
      {
        "lessThanOrEqual": "3.11.2",
        "status": "affected",
        "version": "3.11",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.12.7",
        "status": "affected",
        "version": "3.12",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.0.5",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.1.1",
        "status": "affected",
        "version": "4.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "mongodb-driver-legacy",
    "vendor": "MongoDB Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "4.2.0"
      },
      {
        "lessThanOrEqual": "3.11.2",
        "status": "affected",
        "version": "3.11",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.12.7",
        "status": "affected",
        "version": "3.12",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.0.5",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.1.1",
        "status": "affected",
        "version": "4.1",
        "versionType": "custom"
      }
    ]
  }
]