QID 983841

QID 983841: Nodejs (npm) Security Update for mongodb-client-encryption (GHSA-rjmf-p882-645m)

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS servers certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that dont use Field Level Encryption.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as High - 6.8 severity.

CVSS V2 rated as Medium - 4.3 severity.

Solution

Customers are advised to refer to GHSA-rjmf-p882-645m for updates pertaining to this vulnerability.

Vendor References

GHSA-rjmf-p882-645m - github.com/advisories/GHSA-rjmf-p882-645m

CVEs related to QID 983841

CVE-2021-20327 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-rjmf-p882-645m	mongodb-client-encryption		github.com/advisories/GHSA-rjmf-p882-645m

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].