CVE-2014-3971: Input Validation

Published Dec 25, 2014

Updated

The CmdAuthenticate::authenticateX509 function in db/commands/authenticationcommands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.

Affected Software

2 affected components

MongoDB MongoDB=2.6.0

MongoDB MongoDB=2.6.1

Event History

Dec 25, 2014

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3971?

CVE-2014-3971 is classified as a denial of service vulnerability due to its potential to crash the MongoDB server.

How do I fix CVE-2014-3971?

To fix CVE-2014-3971, upgrade MongoDB to version 2.6.2 or later.

Which versions of MongoDB are affected by CVE-2014-3971?

CVE-2014-3971 affects MongoDB versions 2.6.0 and 2.6.1.

What kind of attack does CVE-2014-3971 enable?

CVE-2014-3971 enables attackers to cause a denial of service by using an invalid X.509 client certificate for authentication.

Is CVE-2014-3971 related to authentication processes in MongoDB?

Yes, CVE-2014-3971 is directly related to the authentication processes within MongoDB, particularly when handling X.509 certificates.