CVE-2017-15535 MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabl...
CriticalCVSS 9.1
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb/mongodb | >= 3.4.0, < 3.4.10 | 3.4.10 |
References
- 101689 third-party-advisory vdb-entry
- jira.mongodb.org issue-tracking vendor-advisory