CVE-2021-20330: Specific replication command with malformed oplog entries can crash secondaries
An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.25; MongoDB Server v4.2 versions prior to 4.2.14; MongoDB Server v4.4 versions prior to 4.4.6.
Other sources
An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20330?
CVE-2021-20330 is a vulnerability that allows an attacker with basic CRUD permissions on a replicated collection to run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries.
Which versions of MongoDB Server are affected by CVE-2021-20330?
CVE-2021-20330 affects MongoDB Server v4.0 versions prior to 4.0.25, MongoDB Server v4.2 versions prior to 4.2.14, and MongoDB Server v4.4 versions prior to 4.4.6.
What is the severity of CVE-2021-20330?
CVE-2021-20330 has a severity rating of medium with a score of 6.5.
How can I fix CVE-2021-20330?
To fix CVE-2021-20330, it is recommended to upgrade to MongoDB Server version 4.0.25 (or later) for v4.0, 4.2.14 (or later) for v4.2, or 4.4.6 (or later) for v4.4.
Where can I find more information about CVE-2021-20330?
You can find more information about CVE-2021-20330 on the MongoDB Jira page: https://jira.mongodb.org/browse/SERVER-36263.