CVE-2024-1351

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-1351
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-1351.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-1351
Aliases
Downstream
Published
2024-03-07T16:10:19.597Z
Modified
2026-07-11T04:14:49.568113207Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
MongoDB Server may allow successful untrusted connection
Details

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28.

Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.

Database specific 
{
    "cwe_ids": [
        "CWE-295"
    ],
    "cna_assigner": "mongodb",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1351.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0.5"
                },
                {
                    "introduced": "6.0"
                },
                {
                    "last_affected": "6.0.13"
                },
                {
                    "introduced": "5.0"
                },
                {
                    "last_affected": "5.0.24"
                },
                {
                    "introduced": "4.4"
                },
                {
                    "last_affected": "4.4.28"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/mongodb/mongo

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo
Events
Introduced
563487e100c4215e2dce98d0af2a6a5a2d67c5cf
Fixed
89d6ffe6fc67b36fd47aff6425087003966588e3
Introduced
1184f004a99660de6f5e745573419bda8a28c0e9
Fixed
17c0d8bbee46f15f1574079e266a9997cebe6d0e
Introduced
e61bf27c2f6a83fed36e5a13c008a32d563babe2
Fixed
bda19256b0e3fa7f6d3d769329ba373a72e9aeb1
Introduced
37d84072b5c5b9fd723db5fa133fb202ad2317f1
Fixed
0eb07427dc794bff511ecbd071687aee6c351cf8
Database specific 
{
    "cpe": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "4.4.0"
        },
        {
            "fixed": "4.4.29"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.25"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.14"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.6"
        }
    ]
}

Affected versions

r4.*
r4.4.0
r4.4.1
r4.4.1-rc0
r4.4.1-rc1
r4.4.1-rc2
r4.4.1-rc3
r4.4.10
r4.4.10-rc0
r4.4.11
r4.4.11-rc0
r4.4.11-rc1
r4.4.12
r4.4.12-rc0
r4.4.12-rc1
r4.4.13
r4.4.13-rc0
r4.4.14
r4.4.14-rc0
r4.4.15
r4.4.15-rc0
r4.4.16
r4.4.16-rc0
r4.4.17
r4.4.17-rc0
r4.4.17-rc1
r4.4.17-rc2
r4.4.18
r4.4.18-rc0
r4.4.19
r4.4.19-rc0
r4.4.19-rc1
r4.4.19-rc2
r4.4.2
r4.4.2-rc0
r4.4.2-rc1
r4.4.20
r4.4.20-rc0
r4.4.21
r4.4.21-rc0
r4.4.22
r4.4.22-rc0
r4.4.22-rc1
r4.4.22-rc2
r4.4.23
r4.4.23-rc0
r4.4.24
r4.4.24-rc0
r4.4.25
r4.4.25-rc0
r4.4.26
r4.4.26-rc0
r4.4.27
r4.4.27-rc0
r4.4.28
r4.4.28-rc0
r4.4.3
r4.4.3-rc0
r4.4.4
r4.4.4-rc0
r4.4.4-rc1
r4.4.5
r4.4.5-rc0
r4.4.6
r4.4.6-rc0
r4.4.7
r4.4.7-rc0
r4.4.7-rc1
r4.4.8
r4.4.8-rc0
r4.4.9
r4.4.9-rc0
r4.4.9-rc1
r5.*
r5.0.0
r5.0.1
r5.0.1-rc0
r5.0.10
r5.0.10-rc0
r5.0.11
r5.0.11-rc0
r5.0.11-rc1
r5.0.12
r5.0.12-rc0
r5.0.13
r5.0.13-rc0
r5.0.14
r5.0.14-rc0
r5.0.15
r5.0.15-rc0
r5.0.15-rc1
r5.0.15-rc2
r5.0.16
r5.0.16-rc0
r5.0.17
r5.0.17-rc0
r5.0.18
r5.0.18-rc0
r5.0.18-rc1
r5.0.18-rc2
r5.0.19
r5.0.19-rc0
r5.0.2
r5.0.2-rc0
r5.0.20
r5.0.20-rc0
r5.0.20-rc1
r5.0.21
r5.0.21-rc0
r5.0.22
r5.0.22-rc0
r5.0.22-rc1
r5.0.23
r5.0.23-rc0
r5.0.24
r5.0.24-rc0
r5.0.3
r5.0.3-rc0
r5.0.3-rc1
r5.0.3-rc2
r5.0.4
r5.0.4-rc0
r5.0.5
r5.0.5-rc0
r5.0.6
r5.0.6-rc0
r5.0.6-rc1
r5.0.6-rc2
r5.0.7
r5.0.7-rc0
r5.0.7-rc1
r5.0.8
r5.0.8-rc0
r5.0.9
r5.0.9-rc0
r5.0.9-rc1
r6.*
r6.0.0
r6.0.1
r6.0.1-rc0
r6.0.10
r6.0.10-rc0
r6.0.11
r6.0.11-rc0
r6.0.12
r6.0.12-rc0
r6.0.12-rc1
r6.0.13
r6.0.13-rc0
r6.0.14-rc0
r6.0.2
r6.0.2-rc0
r6.0.2-rc1
r6.0.3
r6.0.3-rc0
r6.0.3-rc1
r6.0.3-rc2
r6.0.4
r6.0.4-rc0
r6.0.4-rc1
r6.0.5
r6.0.5-rc0
r6.0.5-rc1
r6.0.6
r6.0.6-rc0
r6.0.6-rc1
r6.0.7
r6.0.7-rc0
r6.0.8
r6.0.8-rc0
r6.0.9
r6.0.9-rc0
r6.0.9-rc1
r7.*
r7.0.0
r7.0.1
r7.0.1-rc0
r7.0.2
r7.0.2-rc0
r7.0.2-rc1
r7.0.2-rc2
r7.0.3
r7.0.3-rc0
r7.0.3-rc1
r7.0.4
r7.0.4-rc0
r7.0.5
r7.0.5-rc0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-1351.json"