Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-42233

Bump Windows package dependencies

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Blocker - P1
    • Resolution: Fixed
    • None
    • 3.4.22, 3.6.14, 4.0.11
    • Packaging
    • Fully Compatible
    • ALL
    • v4.2, v4.0, v3.6, v3.4
    • Security 2019-07-15, Security 2019-07-29

    Description

      CVE-2019-2390

      Description
      An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server versions less than 4.0.11, 3.6.14, and 3.4.22 to run attacker defined code as the user running the utility.

      Credit
      Rich Mirch

      Attachments

        Activity

          People

            spencer.jackson@mongodb.com Spencer Jackson
            spencer.jackson@mongodb.com Spencer Jackson
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: