svn commit: r514293 - head/security/vuxml

Fri Oct 11 17:36:38 UTC 2019

Author: pi
Date: Fri Oct 11 17:36:37 2019
New Revision: 514293
URL: https://svnweb.freebsd.org/changeset/ports/514293

Log:
  security/vuxml: mongodb vulnerabilities
  
  - CVE-2019-2386, CVE-2019-2389, CVE-2019-2390
  
  PR:		239717
  Submitted by:	Ronald Klop <ronald-lists at klop.ws>

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Fri Oct 11 17:27:20 2019	(r514292)
+++ head/security/vuxml/vuln.xml	Fri Oct 11 17:36:37 2019	(r514293)
@@ -58,6 +58,108 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="fd2e0ca8-e3ae-11e9-8af7-08002720423d">
+    <topic>mongodb -- Bump Windows package dependencies</topic>
+    <affects>
+      <package>
+	<name>mongodb34</name>
+	<range><lt>3.4.22</lt></range>
+      </package>
+      <package>
+	<name>mongodb36</name>
+	<range><lt>3.6.14</lt></range>
+      </package>
+      <package>
+	<name>mongodb40</name>
+	<range><lt>4.0.11</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Rich Mirch reports:</p>
+	<blockquote cite="https://jira.mongodb.org/browse/SERVER-42233">
+	  <p>An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server versions less than 4.0.11, 3.6.14, and 3.4.22 to run attacker defined code as the user running the utility.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2019-2390</cvename>
+      <url>https://jira.mongodb.org/browse/SERVER-42233</url>
+    </references>
+    <dates>
+      <discovery>2019-08-06</discovery>
+      <entry>2019-09-30</entry>
+    </dates>
+  </vuln>
+
+  <vuln vid="273c6c43-e3ad-11e9-8af7-08002720423d">
+    <topic>mongodb -- Our init scripts check /proc/[pid]/stat should validate that `(${procname})` is the process' command name.</topic>
+    <affects>
+      <package>
+	<name>mongodb34</name>
+	<range><lt>3.4.22</lt></range>
+      </package>
+      <package>
+	<name>mongodb36</name>
+	<range><lt>3.6.14</lt></range>
+      </package>
+      <package>
+	<name>mongodb40</name>
+	<range><lt>4.0.11</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Sicheng Liu of Beijing DBSEC Technology Co., Ltd reports:</p>
+	<blockquote cite="https://jira.mongodb.org/browse/SERVER-40563">
+	  <p>Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2019-2389</cvename>
+      <url>https://jira.mongodb.org/browse/SERVER-40563</url>
+    </references>
+    <dates>
+      <discovery>2019-08-06</discovery>
+      <entry>2019-09-30</entry>
+    </dates>
+  </vuln>
+
+  <vuln vid="880bca8f-e201-11e9-8af7-08002720423d">
+    <topic>mongodb -- Attach IDs to users</topic>
+    <affects>
+      <package>
+	<name>mongodb34</name>
+	<range><lt>3.4.22</lt></range>
+      </package>
+      <package>
+	<name>mongodb36</name>
+	<range><lt>3.6.13</lt></range>
+      </package>
+      <package>
+	<name>mongodb40</name>
+	<range><lt>4.0.9</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Mitch Wasson of Cisco's Advanced Malware Protection Group reports:</p>
+	<blockquote cite="https://jira.mongodb.org/browse/SERVER-38984">
+	  <p>After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2019-2386</cvename>
+      <url>https://jira.mongodb.org/browse/SERVER-38984</url>
+    </references>
+    <dates>
+      <discovery>2019-08-06</discovery>
+      <entry>2019-09-28</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="c360d057-ea8b-11e9-859b-b885849ded8e">
     <topic>mod_perl2 -- execute arbitrary Perl code</topic>
     <affects>
