Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

Apply ordering (override relevance)

CVE-2024-8013 (GCVE-0-2024-8013)

Vulnerability from cvelistv5 – Published: 2024-10-28 12:58 – Updated: 2024-10-28 13:39

Title

CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines

Summary

A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.

Severity

2.2 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-319 - Cleartext Transmission of Sensitive Information

Assigner

mongodb

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/SERVER-96254

Impacted products

2 products

Vendor	Product	Version
MongoDB Inc	mongocryptd	Affected: 5.0 , < 5.0.29 (custom) Affected: 6.0 , < 6.0.17 (custom) Affected: 7.0 , < 7.012 (custom) Affected: 7.3 , < 7.3.4 (custom) cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.0:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.1:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.2:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.3:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.4:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.5:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.6:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.7:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.8:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.9:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.10:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.11:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.12:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.13:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.14:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.15:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.16:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.0:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.1:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.2:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.3:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.4:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.5:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.6:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.7:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.8:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.9:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.10:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.11:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.0:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.1:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.2:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.3:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.0:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.1:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.2:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.3:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.4:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.5:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.6:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.7:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.8:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.9:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.10:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.11:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.12:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.13:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.14:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.15:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.16:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.17:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.18:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.19:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.20:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.21:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.22:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.23:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.24:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.25:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.26:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.27:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.28:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.0:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.1:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.2:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.3:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.4:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.5:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.6:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.7:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.8:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.9:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.10:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.11:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.12:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.13:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.14:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.15:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.16:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.0:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.1:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.2:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.3:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.4:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.5:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.6:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.7:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.8:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.9:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.10:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.11:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.3.0:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.3.1:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.3.2:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.3.3:::::mongodb::
MongoDB Inc	Mongo_crypt_v1.so	Affected: 6.0 , < 6.0.17 (custom) Affected: 7.0 , < 7.0.12 (custom) Affected: 7.3 , < 7.3.4 (custom)

Date Public

2024-10-28 12:57

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8013",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-28T13:39:18.972061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-28T13:39:31.561Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.4:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.5:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.6:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.7:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.8:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.9:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.10:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.11:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.12:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.13:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.14:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.15:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.16:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.4:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.5:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.6:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.7:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.8:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.9:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.10:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.11:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.4:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.5:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.6:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.7:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.8:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.9:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.10:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.11:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.12:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.13:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.14:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.15:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.16:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.17:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.18:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.19:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.20:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.21:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.22:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.23:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.24:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.25:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.26:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.27:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.28:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.4:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.5:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.6:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.7:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.8:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.9:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.10:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.11:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.12:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.13:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.14:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.15:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.16:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.4:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.5:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.6:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.7:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.8:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.9:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.10:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.11:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.3.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.3.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.3.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.3.3:*:*:*:*:mongodb:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "mongocryptd",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "5.0.29",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.17",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.012",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.3.4",
              "status": "affected",
              "version": "7.3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mongo_crypt_v1.so",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "6.0.17",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.12",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.3.4",
              "status": "affected",
              "version": "7.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-10-28T12:57:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior t\u003c/span\u003eo 5.0.29, v\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319: Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-28T12:58:05.317Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-96254"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2024-8013",
    "datePublished": "2024-10-28T12:58:05.317Z",
    "dateReserved": "2024-08-20T15:39:32.550Z",
    "dateUpdated": "2024-10-28T13:39:31.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-8013 (GCVE-0-2024-8013)

Vulnerability from nvd – Published: 2024-10-28 12:58 – Updated: 2024-10-28 13:39

Title

CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines

Summary

A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.

Severity

2.2 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-319 - Cleartext Transmission of Sensitive Information

Assigner

mongodb

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/SERVER-96254

Impacted products

2 products

Vendor	Product	Version
MongoDB Inc	mongocryptd	Affected: 5.0 , < 5.0.29 (custom) Affected: 6.0 , < 6.0.17 (custom) Affected: 7.0 , < 7.012 (custom) Affected: 7.3 , < 7.3.4 (custom) cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.0:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.1:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.2:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.3:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.4:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.5:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.6:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.7:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.8:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.9:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.10:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.11:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.12:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.13:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.14:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.15:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.16:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.0:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.1:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.2:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.3:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.4:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.5:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.6:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.7:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.8:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.9:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.10:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.11:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.0:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.1:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.2:::::mongodb:: cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.3:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.0:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.1:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.2:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.3:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.4:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.5:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.6:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.7:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.8:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.9:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.10:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.11:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.12:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.13:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.14:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.15:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.16:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.17:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.18:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.19:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.20:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.21:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.22:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.23:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.24:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.25:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.26:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.27:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:5.0.28:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.0:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.1:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.2:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.3:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.4:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.5:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.6:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.7:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.8:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.9:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.10:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.11:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.12:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.13:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.14:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.15:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:6.0.16:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.0:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.1:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.2:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.3:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.4:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.5:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.6:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.7:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.8:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.9:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.10:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.0.11:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.3.0:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.3.1:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.3.2:::::mongodb:: cpe:2.3:a:mongodb:mongocryptd:7.3.3:::::mongodb::
MongoDB Inc	Mongo_crypt_v1.so	Affected: 6.0 , < 6.0.17 (custom) Affected: 7.0 , < 7.0.12 (custom) Affected: 7.3 , < 7.3.4 (custom)

Date Public

2024-10-28 12:57

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8013",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-28T13:39:18.972061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-28T13:39:31.561Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.4:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.5:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.6:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.7:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.8:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.9:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.10:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.11:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.12:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.13:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.14:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.15:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.16:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.4:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.5:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.6:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.7:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.8:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.9:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.10:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.0.11:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongo_crypt_v1.so:7.3.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.4:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.5:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.6:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.7:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.8:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.9:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.10:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.11:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.12:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.13:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.14:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.15:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.16:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.17:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.18:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.19:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.20:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.21:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.22:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.23:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.24:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.25:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.26:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.27:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:5.0.28:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.4:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.5:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.6:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.7:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.8:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.9:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.10:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.11:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.12:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.13:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.14:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.15:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:6.0.16:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.3:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.4:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.5:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.6:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.7:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.8:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.9:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.10:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.0.11:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.3.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.3.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.3.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:mongocryptd:7.3.3:*:*:*:*:mongodb:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "mongocryptd",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "5.0.29",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.17",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.012",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.3.4",
              "status": "affected",
              "version": "7.3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mongo_crypt_v1.so",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "6.0.17",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.12",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.3.4",
              "status": "affected",
              "version": "7.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-10-28T12:57:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior t\u003c/span\u003eo 5.0.29, v\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319: Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-28T12:58:05.317Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-96254"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2024-8013",
    "datePublished": "2024-10-28T12:58:05.317Z",
    "dateReserved": "2024-08-20T15:39:32.550Z",
    "dateUpdated": "2024-10-28T13:39:31.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

2 vulnerabilities found for mongocryptd by mongodb

CVE-2024-8013 (GCVE-0-2024-8013)

CVE-2024-8013 (GCVE-0-2024-8013)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

2 vulnerabilities found for mongocryptd by mongodb

CVE-2024-8013 (GCVE-0-2024-8013)

CVE-2024-8013 (GCVE-0-2024-8013)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.