MongoDB Java Driver 4.0.0 - for MongoDB

CPE Details

MongoDB Java Driver 4.0.0 - for MongoDB
mongodb
java_driver
4.0.0
2021-02-26
10h49 +00:00
2021-04-15
16h38 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:mongodb:java_driver:4.0.0:-:*:*:*:mongodb:*:*

Informations

Vendor

mongodb

Product

java_driver

Version

4.0.0

Update

-

Target Software

mongodb

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2021-20328 2021-02-25 16h30 +00:00 Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.
6.8
Medium
The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.