What is the severity of CVE-2017-15535?

CVE-2017-15535 is classified as a medium severity vulnerability that could lead to denial of service or memory modification.

How do I fix CVE-2017-15535?

To fix CVE-2017-15535, ensure that the networkMessageCompressors setting is disabled in your MongoDB configuration.

Which versions of MongoDB are affected by CVE-2017-15535?

CVE-2017-15535 affects MongoDB versions 3.4.x before 3.4.10 and 3.5.x-development.

What type of attack can exploit CVE-2017-15535?

CVE-2017-15535 can be exploited by a malicious attacker to launch denial-of-service attacks or to modify the memory of the MongoDB server.

Is the networkMessageCompressors setting enabled by default in MongoDB?

No, the networkMessageCompressors setting is disabled by default in MongoDB.

Vulnerability/
CVE-2017-15535

critical

9.1

1/11/2017

22/11/2017

CVE-2017-15535

First published: Wed Nov 01 2017(Updated: )

MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
MongoDB Server	>=3.4.0<3.4.10

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2017-15535?
CVE-2017-15535 is classified as a medium severity vulnerability that could lead to denial of service or memory modification.
How do I fix CVE-2017-15535?
To fix CVE-2017-15535, ensure that the networkMessageCompressors setting is disabled in your MongoDB configuration.
Which versions of MongoDB are affected by CVE-2017-15535?
CVE-2017-15535 affects MongoDB versions 3.4.x before 3.4.10 and 3.5.x-development.
What type of attack can exploit CVE-2017-15535?
CVE-2017-15535 can be exploited by a malicious attacker to launch denial-of-service attacks or to modify the memory of the MongoDB server.
Is the networkMessageCompressors setting enabled by default in MongoDB?
No, the networkMessageCompressors setting is disabled by default in MongoDB.

agent/references
agent/type
agent/last-modified-date
agent/first-publish-date
agent/severity
agent/author
agent/softwarecombine
agent/tags
agent/event
agent/description
collector/nvd-index
agent/software-canonical-lookup-request
vendor/mongodb
canonical/mongodb server
version/mongodb server/3.4.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2017-15535?
CVE-2017-15535 is classified as a medium severity vulnerability that could lead to denial of service or memory modification.
How do I fix CVE-2017-15535?
To fix CVE-2017-15535, ensure that the networkMessageCompressors setting is disabled in your MongoDB configuration.
Which versions of MongoDB are affected by CVE-2017-15535?
CVE-2017-15535 affects MongoDB versions 3.4.x before 3.4.10 and 3.5.x-development.
What type of attack can exploit CVE-2017-15535?
CVE-2017-15535 can be exploited by a malicious attacker to launch denial-of-service attacks or to modify the memory of the MongoDB server.
Is the networkMessageCompressors setting enabled by default in MongoDB?
No, the networkMessageCompressors setting is disabled by default in MongoDB.