World-readable .dbshell history file in mongodb
Summary
DLA-588-2: mongodb - regression update. Affects mongodb versions < 1:2.0.6-1.1+deb7u1. Fixed in 1:2.0.6-1.1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MongoDB is a popular open-source NoSQL database management system. It provides high performance, scalability, and flexibility for storing and retrieving data. The vulnerability in MongoDB version 2.0.6-1+deb7u1 for Debian 7 Wheezy allows the .dbshell history file to be world-readable, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2016-6494, arises from the world-readable .dbshell history file. This file contains a history of commands executed in the MongoDB shell, including potentially sensitive information such as database credentials. An attacker with access to the file can retrieve this information and use it for malicious purposes. This vulnerability poses a risk to the confidentiality and integrity of the MongoDB deployment.
How To Fix
Minimum fixed version
1:2.0.6-1.1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mongodbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, upgrading to the fixed version is the recommended solution.
Conclusion
The world-readable .dbshell history file vulnerability in MongoDB version 2.0.6-1+deb7u1 for Debian 7 Wheezy can lead to unauthorized access to sensitive information. To mitigate this vulnerability, it is crucial to upgrade to the fixed version of MongoDB. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for mongodb →
FAQ
The vulnerability allows unauthorized access to the .dbshell history file, potentially exposing sensitive information such as database credentials.
Users of MongoDB version 2.0.6-1+deb7u1 for Debian 7 Wheezy are affected by this vulnerability.
There is no known exploit for this vulnerability at the moment.
The recommended mitigation is to upgrade to the fixed version of MongoDB (2.0.6-1+deb7u1 or later).
You can find more information about this vulnerability in the Debian LTS security advisories and the CVE-2016-6494 entry.
Related vulnerabilities
Recent vulnerabilities recorded for mongodb.
