CVE-2018-20805

NameCVE-2018-20805
DescriptionA user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mongodb (PTS)jessie1:2.4.10-5+deb8u1fixed
stretch (security), stretch (lts), stretch1:3.2.11-2+deb9u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mongodbsourcejessie(not affected)
mongodbsourcestretch(not affected)
mongodbsource(unstable)(unfixed)

Notes

[stretch] - mongodb <not-affected> (Vulnerable code introduced later)
https://jira.mongodb.org/browse/SERVER-38164
https://github.com/mongodb/mongo/commit/66316884a4b1180a8cceb6381e3c51e56586fc3e (v3.6.10, SSPL)
Introduced by: https://github.com/mongodb/mongo/commit/f77527a942347313e2848e050e89480bc3cadb95 (v3.5.4)
[jessie] - mongodb <not-affected> (Vulnerable code introduced later)

Search for package or bug name: Reporting problems