CVE-2019-20925: Denial of service via malformed network packet
First published: Tue Nov 24 2020(Updated: )
An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.
Credit: cna@mongodb.com cna@mongodb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MongoDB MongoDB | >=3.4.0<3.4.24 | |
| MongoDB MongoDB | >=3.6.0<3.6.15 | |
| MongoDB MongoDB | >=4.0.0<4.0.13 | |
| MongoDB MongoDB | >=4.2.0<4.2.1 | |
| >=3.4.0<3.4.24 | ||
| >=3.6.0<3.6.15 | ||
| >=4.0.0<4.0.13 | ||
| >=4.2.0<4.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-20925?
CVE-2019-20925 is a vulnerability that allows an unauthenticated client to trigger denial of service in MongoDB Server versions prior to 4.2.1, 4.0.13, and 3.6.15 by issuing specially crafted wire protocol messages.
How does CVE-2019-20925 affect MongoDB?
CVE-2019-20925 affects MongoDB Server versions prior to 4.2.1, 4.0.13, and 3.6.15 by causing the message decompressor to incorrectly allocate memory, leading to denial of service.
What is the severity of CVE-2019-20925?
CVE-2019-20925 has a severity rating of 7.5 (High).
How can I fix CVE-2019-20925?
To fix CVE-2019-20925, upgrade MongoDB Server to version 4.2.1, 4.0.13, or 3.6.15.
Where can I find more information about CVE-2019-20925?
More information about CVE-2019-20925 can be found at the following reference link: https://jira.mongodb.org/browse/SERVER-43751
- agent/type
- agent/weakness
- agent/severity
- agent/remedy
- agent/title
- agent/references
- agent/author
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- collector/nvd-api
- source/NVD
- vendor/mongodb
- canonical/mongodb mongodb
- version/mongodb mongodb/3.4.0
- version/mongodb mongodb/3.6.0
- version/mongodb mongodb/4.0.0
- version/mongodb mongodb/4.2.0