MongoDB was found to be affected by a memory over-read bug that can be used by an authenticated user (if applicable) to obtain raw MongoDB server process memory contents via incorrect BSON object length.

This issue does not seem to cross a security boundary under most deployments, but for some it could, like differently-privileged MongoDB users, data already deleted from the DB yet staying in process memory, or/and metadata that is not normally retrievable.

References: http://seclists.org/oss-sec/2014/q1/27 http://blog.ptsecurity.com/2012/11/attacking-mongodb.html https://github.com/cyberpunkych/attackingmongodb (The files used for the attack demonstration.)