[SERVER-35636] Renaming collection for applyOps needs to check completeness of target namespace Created: 16/Jun/18  Updated: 29/Oct/23  Resolved: 04/Mar/19

Status: Closed
Project: Core Server
Component/s: Replication
Affects Version/s: None
Fix Version/s: 3.6.13, 4.1.9, 4.0.10

Type: Bug Priority: Major - P3
Reporter: Vesselina Ratcheva (Inactive) Assignee: Pavithra Vetriselvan
Resolution: Fixed Votes: 0
Labels: former-quick-wins
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Backports
Depends
Related
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v4.0, v3.6, v3.4
Sprint: Repl 2019-02-25, Repl 2019-03-11
Participants:
Linked BF Score: 49

 Description   
CVE-2018-20804

Title: Invariant failure in applyOps

Description:
A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.10; v3.6 versions prior to 3.6.13.

CVSS score:
This issue's CVSS:3.1 severity is scored at 6.5 using the following scoring metrics:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions:
MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.10; v3.6 versions prior to 3.6.13.

CWE: CWE-20: Improper Input Validation



 Comments   
Comment by Githook User [ 19/Apr/19 ]

Author:

{'email': 'pvselvan@umich.edu', 'name': 'Pavi Vetriselvan', 'username': 'pvselvan'}

Message: SERVER-35636 renameCollectionForApplyOps checks for complete namespace

(cherry picked from commit 35c1b1f588f04926a958ad2fe4d9c59d79f81e8b)
Branch: v3.6
https://github.com/mongodb/mongo/commit/736d214fe2b1ad7cd9b57c05571b53628124668e

Comment by Githook User [ 19/Apr/19 ]

Author:

{'name': 'Pavi Vetriselvan', 'username': 'pvselvan', 'email': 'pvselvan@umich.edu'}

Message: SERVER-35636 renameCollectionForApplyOps checks for complete namespace

(cherry picked from commit 35c1b1f588f04926a958ad2fe4d9c59d79f81e8b)
Branch: v4.0
https://github.com/mongodb/mongo/commit/7e2820d965f0bd6b7682af92242cd253c3d083df

Comment by Githook User [ 04/Mar/19 ]

Author:

{'name': 'Pavi Vetriselvan', 'email': 'pvselvan@umich.edu', 'username': 'pvselvan'}

Message: SERVER-35636 renameCollectionForApplyOps checks for complete namespace
Branch: master
https://github.com/mongodb/mongo/commit/35c1b1f588f04926a958ad2fe4d9c59d79f81e8b

Generated at Thu Feb 08 04:40:28 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.