CVE-2024-8013
Description
A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.
How to fix
- mongodb mongo_crypt_v1.so6.0.17, 7.0.12, 7.3.4 or later
- mongodb mongocryptd5.0.29, 6.0.17, 7.0.12, 7.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb mongo_crypt_v1.so | 6.0.0 ≤ v < 6.0.17, 7.0.0 ≤ v < 7.0.12, 7.3.0 ≤ v < 7.3.4 | 6.0.17, 7.0.12, 7.3.4 |
| mongodb mongocryptd | 5.0.0 ≤ v < 5.0.29, 6.0.0 ≤ v < 6.0.17, 7.0.0 ≤ v < 7.0.12, 7.3.0 ≤ v < 7.3.4 | 5.0.29, 6.0.17, 7.0.12, 7.3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.