// For flags

CVE-2021-20328

MongoDB Java driver client-side field level encryption not verifying KMS host name

Severity Score

6.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

Las versiones específicas del controlador de Java que soportan el client-side field level encryption (CSFLE) presentan un fallo al realizar una comprobación correcta del nombre del host en el certificado del servidor KMS. Esta vulnerabilidad, en combinación con un ataque MITM activo en una posición de red privilegiada, podría resultar en una interceptación del tráfico entre el controlador de Java y el servicio KMS, haciendo que el cifrado a nivel de campo sea ineficaz. Este problema se detectó durante las pruebas internas y afecta a todas las versiones del controlador de Java que soportan CSFLE. Los controladores Java async, Scala y flujos reactivos no están afectados. Esta vulnerabilidad no afecta a las cargas de tráfico del controlador con servicios clave compatibles con CSFLE que se originan en aplicaciones que residen dentro de los tejidos de red de AWS, GCP y Azure debido a los controles de compensación en estos entornos. Este problema no afecta a las cargas de trabajo de los controladores que no usan Field Level Encryption

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Adjacent
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2020-12-17 CVE Reserved
  • 2021-02-25 CVE Published
  • 2023-10-02 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mongodb
Search vendor "Mongodb"
 Java Driver
Search vendor "Mongodb" for product "Java Driver"
 >= 3.11.0 < 3.11.3
Search vendor "Mongodb" for product "Java Driver" and version " >= 3.11.0 < 3.11.3"
mongodb
Affected
Mongodb
Search vendor "Mongodb"
 Java Driver
Search vendor "Mongodb" for product "Java Driver"
 >= 3.12.0 < 3.12.8
Search vendor "Mongodb" for product "Java Driver" and version " >= 3.12.0 < 3.12.8"
mongodb
Affected
Mongodb
Search vendor "Mongodb"
 Java Driver
Search vendor "Mongodb" for product "Java Driver"
 >= 4.0.0 < 4.0.6
Search vendor "Mongodb" for product "Java Driver" and version " >= 4.0.0 < 4.0.6"
mongodb
Affected
Mongodb
Search vendor "Mongodb"
 Java Driver
Search vendor "Mongodb" for product "Java Driver"
 >= 4.1.0 < 4.1.2
Search vendor "Mongodb" for product "Java Driver" and version " >= 4.1.0 < 4.1.2"
mongodb
Affected
Mongodb
Search vendor "Mongodb"
 Java Driver
Search vendor "Mongodb" for product "Java Driver"
 >= 4.2.0 < 4.2.1
Search vendor "Mongodb" for product "Java Driver" and version " >= 4.2.0 < 4.2.1"
mongodb
Affected
Quarkus
Search vendor "Quarkus"
 Quarkus
Search vendor "Quarkus" for product "Quarkus"
 < 1.13.3
Search vendor "Quarkus" for product "Quarkus" and version " < 1.13.3"
-
Affected
Quarkus
Search vendor "Quarkus"
 Quarkus
Search vendor "Quarkus" for product "Quarkus"
 1.13.3
Search vendor "Quarkus" for product "Quarkus" and version "1.13.3"
-
Affected