CVE-2015-4411: High severity MongoDB Bson Ruby vulnerability
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
Other sources
The following Denial of Service issue was discovered in Moped Ruby gem:
If a crafted value will be passed to Moped::BSON::ObjecId.legal? method, this will cause Moped to think MongoDB is down, and ping it 39 more times with intervals. In other words, Moped will keep a worker busy for 5 seconds and make x40 requests to MongoDB.
CVE-2015-4411 was assigned to it: http://seclists.org/oss-sec/2015/q2/653
Additional details might be found here: http://sakurity.com/blog/2015/06/04/mongorubyregexp.html
The fix can be found here: https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999
— Red Hat
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4411?
CVE-2015-4411 has a medium severity rating due to its potential to cause denial of service.
What are the affected versions of CVE-2015-4411?
CVE-2015-4411 affects versions of mongodb/bson-ruby prior to 3.0.4.
How do I fix CVE-2015-4411?
To fix CVE-2015-4411, upgrade to bson versions 3.0.4 or later.
What type of attack does CVE-2015-4411 enable?
CVE-2015-4411 allows remote attackers to cause a denial of service through resource consumption.
Is there a direct relation between CVE-2015-4411 and CVE-2015-4410?
Yes, CVE-2015-4411 is related to an incomplete fix for CVE-2015-4410.