A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A user authorized to perform database queries may cause denial of service by issuing specially crafted     queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects     MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB     Server v4.0 versions prior to 4.0.19. (CVE-2020-7923)

  - A user authorized to perform database queries may cause denial of service by issuing specially crafted     queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects:
    MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions     prior to 4.0.19. (CVE-2020-7923)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Dell Wyse Management Suite installed on the remote Windows host is prior to 3.2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Incorrect validation of user input in the role name parser may lead to use of uninitialized memory     allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service.
    This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc12; v4.2 versions prior to     4.2.9. (CVE-2020-7925)

  - A user authorized to perform database queries may trigger a denial of service condition by issuing specially crafted     queries which trigger an invariant in the IndexBoundsBuilder. This issue affects: MongoDB Inc. MongoDB     Server v4.2 versions prior to 4.2.2 as used in Dell Wyse Management Suite. (CVE-2019-20924)

  - A user authorized to perform database queries may trigger a denial of service condition by issuing specially crafted     queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB     Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prior to 4.0.20; v3.6     versions prior to 3.6.20 as used in Dell Wyse Management Suite. (CVE-2019-2392)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A denial of service vulnerability was discovered in mongodb, an object/document-oriented database, whereby a user authorized to perform database queries may issue specially crafted queries, which violate an invariant in the query subsystem's support for geoNear.

For Debian 9 stretch, this problem has been fixed in version 1:3.2.11-2+deb9u2.

We recommend that you upgrade your mongodb packages.

For the detailed security status of mongodb please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/mongodb

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
260333	Linux Distros Unpatched Vulnerability : CVE-2020-7923	Nessus	Misc.	medium
148360	Dell Wyse Management Suite < 3.2 Multiple Vulnerabilities (DSA-2021-070)	Nessus	Windows	medium
139776	Debian DLA-2344-1 : mongodb security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-7923

medium

Tenable Plugins

medium

medium

medium