Re: git: 7ec6fda16269 - main - security/vuxml: Add mongodb vulnerabilities

From: Fernando_Apesteguía <fernape_at_freebsd.org>
Date: Tue, 07 Oct 2025 06:22:21 UTC
On Mon, Oct 6, 2025 at 9:07 PM Ronald Klop <ronald-lists@klop.ws> wrote:

> Hi Fernando,
>
> Thanks for filling vuxml for the mongodb issues.
>
> Mind that mongodb80 will never contain 8.1.X, but only 8.0.X.
> So '<lt>8.1.2</lt>' will always be true, as 8.0.X will always be less than
> 8.1.2. The same happens with '<lt>8.1.0</lt>'.
>
> See https://www.mongodb.com/docs/manual/reference/versioning/ for an
> explanation about MongoDB versioning. The port van only contain the
> Community edition for on-premise installation AFAIK. This changes again
> with 8.2, but that version is not in the ports tree nowadays.
>
>
You're totally right.

Should be fixed by now.

Thanks!


> Regards,
> Ronald.
>
>
>
> *Van:* "Fernando Apesteguía" <fernape@FreeBSD.org>
> *Datum:* maandag, 6 oktober 2025 17:44
> *Aan:* ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org,
> dev-commits-ports-main@FreeBSD.org
> *Onderwerp:* git: 7ec6fda16269 - main - security/vuxml: Add mongodb
> vulnerabilities
>
> The branch main has been updated by fernape:
>
> URL:
> https://cgit.FreeBSD.org/ports/commit/?id=7ec6fda162694d1ef177aef2cc8f88174d4c8716
>
> commit 7ec6fda162694d1ef177aef2cc8f88174d4c8716
> Author:     Fernando Apesteguía <fernape@FreeBSD.org>
> AuthorDate: 2025-10-06 15:43:39 +0000
> Commit:     Fernando Apesteguía <fernape@FreeBSD.org>
> CommitDate: 2025-10-06 15:43:39 +0000
>
>     security/vuxml: Add mongodb vulnerabilities
>
>      * CVE-2025-10061
>      * CVE-2025-10060
>      * CVE-2025-10059
>      * CVE-2025-7259
> ---
>  security/vuxml/vuln/2025.xml | 146
> +++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 146 insertions(+)
>
> diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
> index cec42b929a0c..1990b05803ef 100644
> --- a/security/vuxml/vuln/2025.xml
> +++ b/security/vuxml/vuln/2025.xml
> @@ -1,3 +1,149 @@
> +  <vuln vid="a5395e02-a2ca-11f0-8402-b42e991fc52e">
> +    <topic>mongodb -- Malformed $group Query May Cause MongoDB Server to
> Crash</topic>
> +    <affects>
> +      <package>
> +   <name>mongodb60</name>
> +   <range><lt>6.0.25</lt></range>
> +      </package>
> +      <package>
> +   <name>mongodb70</name>
> +   <range><lt>7.0.22</lt></range>
> +      </package>
> +      <package>
> +   <name>mongodb80</name>
> +   <range><lt>8.1.2</lt></range>
> +      </package>
> +    </affects>
> +    <description>
> +   <bodyhttp://www.w3.org/1999/xhtml">http://www.w3.org/1999/xhtml">
> +   <p>cna@mongodb.com reports:</p>
> +   <blockquote cite="https://jira.mongodb.org/browse/SERVER-99616">
> +     <p>An authorized user can cause a crash in the MongoDB Server through
> +   a specially crafted $group query.  This vulnerability is related
> +   to the incorrect handling of certain accumulator functions when
> +   additional parameters are specified within the $group operation.
> +   This vulnerability could lead to denial of service if triggered
> +   repeatedly.  This issue affects MongoDB Server v6.0 versions prior
> +   to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22, MongoDB
> +   Server v8.0 versions prior to 8.0.12 and MongoDB Server v8.1 versions
> +   prior to 8.1.2</p>
> +   </blockquote>
> +   </body>
> +    </description>
> +    <references>
> +      <cvename>CVE-2025-10061</cvename>
> +      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10061</url>
> +    </references>
> +    <dates>
> +      <discovery>2025-09-05</discovery>
> +      <entry>2025-10-06</entry>
> +    </dates>
> +  </vuln>
> +
> +  <vuln vid="6d16b410-a2ca-11f0-8402-b42e991fc52e">
> +    <topic>mongodb -- MongoDB may be susceptible to Invariant Failure in
> Transactions due Upsert Operation</topic>
> +    <affects>
> +      <package>
> +   <name>mongodb60</name>
> +   <range><lt>6.0.25</lt></range>
> +      </package>
> +      <package>
> +   <name>mongodb70</name>
> +   <range><lt>7.0.22</lt></range>
> +      </package>
> +      <package>
> +   <name>mongodb80</name>
> +   <range><lt>8.0.12</lt></range>
> +      </package>
> +    </affects>
> +    <description>
> +   <bodyhttp://www.w3.org/1999/xhtml">http://www.w3.org/1999/xhtml">
> +   <p>cna@mongodb.com reports:</p>
> +   <blockquote cite="https://jira.mongodb.org/browse/SERVER-95524">
> +     <p>MongoDB Server may allow upsert operations retried
> +     within a transaction to violate unique index constraints,
> +     potentially causing an invariant failure and server crash
> +     during commit. This issue may be triggered by improper
> +     WriteUnitOfWork state management.</p>
> +   </blockquote>
> +   </body>
> +    </description>
> +    <references>
> +      <cvename>CVE-2025-10060</cvename>
> +      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10060</url>
> +    </references>
> +    <dates>
> +      <discovery>2025-09-05</discovery>
> +      <entry>2025-10-06</entry>
> +    </dates>
> +  </vuln>
> +
> +  <vuln vid="4329e3bd-a2ca-11f0-8402-b42e991fc52e">
> +    <topic>mongodb -- MongoDB Server router will crash when incorrect
> lsid is set on a sharded query</topic>
> +    <affects>
> +      <package>
> +   <name>mongodb60</name>
> +   <range><lt>6.0.24</lt></range>
> +      </package>
> +      <package>
> +   <name>mongodb70</name>
> +   <range><lt>7.0.18</lt></range>
> +      </package>
> +      <package>
> +   <name>mongodb80</name>
> +   <range><lt>8.0.6</lt></range>
> +      </package>
> +    </affects>
> +    <description>
> +   <bodyhttp://www.w3.org/1999/xhtml">http://www.w3.org/1999/xhtml">
> +   <p>cna@mongodb.com reports:</p>
> +   <blockquote cite="https://jira.mongodb.org/browse/SERVER-100901">
> +     <p>An improper setting of the lsid field on any sharded query can
> cause
> +   a crash in MongoDB routers.  This issue occurs when a generic
> +   argument (lsid) is provided in a case when it is not applicable.</p>
> +   </blockquote>
> +   </body>
> +    </description>
> +    <references>
> +      <cvename>CVE-2025-10059</cvename>
> +      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10059</url>
> +    </references>
> +    <dates>
> +      <discovery>2025-09-05</discovery>
> +      <entry>2025-10-06</entry>
> +    </dates>
> +  </vuln>
> +
> +  <vuln vid="92880bca-a2c9-11f0-8402-b42e991fc52e">
> +    <topic>mongodb -- Certain Queries May Cause MongoDB Server to
> Crash</topic>
> +    <affects>
> +      <package>
> +   <name>mongodb80</name>
> +   <range><lt>8.1.0</lt></range>
> +      </package>
> +    </affects>
> +    <description>
> +   <bodyhttp://www.w3.org/1999/xhtml">http://www.w3.org/1999/xhtml">
> +   <p>cna@mongodb.com reports:</p>
> +   <blockquote cite="https://jira.mongodb.org/browse/SERVER-102693">
> +     <p>An authorized user can issue queries with duplicate _id fields,
> +   that leads to unexpected behavior in MongoDB Server, which may
> +   result to crash.  This issue can only be triggered by authorized
> +   users and cause Denial of Service.  This issue affects MongoDB
> +   Server v8.1 version 8.1.0.</p>
> +   </blockquote>
> +   </body>
> +    </description>
> +    <references>
> +      <cvename>CVE-2025-7259</cvename>
> +      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-7259</url>
> +    </references>
> +    <dates>
> +      <discovery>2025-07-07</discovery>
> +      <entry>2025-10-06</entry>
> +    </dates>
> +  </vuln>
> +
>    <vuln vid="a9dc3c61-a20f-11f0-91d8-b42e991fc52e">
>      <topic>mongodb -- MongoDB Server access to non-initialized
> memory</topic>
>      <affects>
> ------------------------------
>
>
>
>