Bug 738760 (CVE-2020-7923)

Summary:	<dev-db/mongodb-{4.0.19,4.2.8}: Authenticated DoS (CVE-2020-7923)
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	hydrapolic, proxy-maint, ultrabug
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://jira.mongodb.org/browse/SERVER-47773
Whiteboard:	B3 [noglsa]
Package list:	dev-db/mongodb-4.0.19	Runtime testing required:	---
Bug Depends on:	735276, 738796
Bug Blocks:

Description John Helmert III archtester

2020-08-24 00:52:51 UTC

CVE-2020-7923:

A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.5 versions prior to 4.5.1; v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions prior to 4.0.19.


We need 4.0.19 and 4.2.8 stabilized. 4.2.8 stabilization is already happening in bug 735276, so we'll depend on it here. Maintainer, let us know if 4.0.19 is ready to stable.

Comment 1 Sam James archtester

2020-09-28 22:09:04 UTC

Please cleanup.

Comment 2 Ultrabug gentoo-dev

2020-10-07 07:52:28 UTC

All cleaned up!

Comment 3 John Helmert III archtester

2020-10-07 14:12:28 UTC

Thanks, all done.