Unrated severityNVD Advisory· Published Dec 15, 2021· Updated Sep 16, 2024
Specific replication command with malformed oplog entries can crash secondaries
CVE-2021-20330
Description
An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.
Affected products
2- MongoDB Inc./MongoDB Serverv5Range: 4.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- jira.mongodb.org/browse/SERVER-36263mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.