CVE-2021-20331
Description
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.
How to fix
- mongodb c\#_driver2.12.2 or later
- mongodb.driver2.12.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb c\#_driver | 2.12.0 ≤ v < 2.12.2, 2.11.0 | 2.12.2 |
| mongodb.driverNuGet | 2.11.0 ≤ v < 2.12.2 | 2.12.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.