[SERVER-38164] $or pushdown optimization does not correctly handle $not within an $elemMatch Created: 15/Nov/18  Updated: 29/Oct/23  Resolved: 05/Dec/18

Status: Closed
Project: Core Server
Component/s: Querying
Affects Version/s: 3.6.0, 4.0.0, 4.1.5
Fix Version/s: 3.6.10, 4.0.5, 4.1.7

Type: Bug Priority: Critical - P2
Reporter: Charlie Swanson Assignee: Bernard Gorman
Resolution: Fixed Votes: 0
Labels: SWNA
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Backports
Depends
Duplicate
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v4.0, v3.6
Sprint: Query 2018-12-03, Query 2018-12-17
Participants:
Case:

 Description   
CVE-2018-20805

Title: Invariant with $elemMatch

Description:
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.5; v3.6 versions prior to 3.6.10.

CVSS score:
This issue's CVSS:3.1 severity is scored at 6.5 using the following scoring metrics:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions
MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.5; v3.6 versions prior to 3.6.10.

CWE: CWE-834: Excessive Iteration



 Comments   
Comment by Githook User [ 06/Dec/18 ]

Author:

{'name': 'Bernard Gorman', 'email': 'bernard.gorman@gmail.com', 'username': 'gormanb'}

Message: SERVER-38164 $or pushdown optimization does not correctly handle $not within an $elemMatch

(cherry picked from commit 94d0e046baa64d1aa1a6af97e2d19bb466cc1ff5)
Branch: v3.6
https://github.com/mongodb/mongo/commit/66316884a4b1180a8cceb6381e3c51e56586fc3e

Comment by Githook User [ 05/Dec/18 ]

Author:

{'name': 'Bernard Gorman', 'email': 'bernard.gorman@gmail.com', 'username': 'gormanb'}

Message: SERVER-38164 $or pushdown optimization does not correctly handle $not within an $elemMatch

(cherry picked from commit 94d0e046baa64d1aa1a6af97e2d19bb466cc1ff5)
Branch: v4.0
https://github.com/mongodb/mongo/commit/1a7d130a3adf89b98c6df92326a3174a77a9af7c

Comment by Githook User [ 05/Dec/18 ]

Author:

{'name': 'Bernard Gorman', 'email': 'bernard.gorman@gmail.com', 'username': 'gormanb'}

Message: SERVER-38164 $or pushdown optimization does not correctly handle $not within an $elemMatch
Branch: master
https://github.com/mongodb/mongo/commit/94d0e046baa64d1aa1a6af97e2d19bb466cc1ff5

Generated at Thu Feb 08 04:48:08 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.