Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.
Las versiones específicas del controlador de Java que soportan el client-side field level encryption (CSFLE) presentan un fallo al realizar una comprobación correcta del nombre del host en el certificado del servidor KMS. Esta vulnerabilidad, en combinación con un ataque MITM activo en una posición de red privilegiada, podría resultar en una interceptación del tráfico entre el controlador de Java y el servicio KMS, haciendo que el cifrado a nivel de campo sea ineficaz. Este problema se detectó durante las pruebas internas y afecta a todas las versiones del controlador de Java que soportan CSFLE. Los controladores Java async, Scala y flujos reactivos no están afectados. Esta vulnerabilidad no afecta a las cargas de tráfico del controlador con servicios clave compatibles con CSFLE que se originan en aplicaciones que residen dentro de los tejidos de red de AWS, GCP y Azure debido a los controles de compensación en estos entornos. Este problema no afecta a las cargas de trabajo de los controladores que no usan Field Level Encryption
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
| Attack Vector | ADJACENT_NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
AV:A/AC:M/Au:N/C:P/I:P/A:N
| Access Vector | ADJACENT_NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-295
|
| [email protected] | Primary |
en
CWE-295
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| mongodb | java_driver | * | <built-in method update of dict object at 0x717bdc85de80> | Application |
| mongodb | java_driver | * | <built-in method update of dict object at 0x717bdc85eb00> | Application |
| mongodb | java_driver | * | <built-in method update of dict object at 0x717bdacbc700> | Application |
| mongodb | java_driver | * | <built-in method update of dict object at 0x717bdaabf600> | Application |
| mongodb | java_driver | * | <built-in method update of dict object at 0x717bdc85c680> | Application |
| quarkus | quarkus | * | <built-in method update of dict object at 0x717bdc85fa40> | Application |
| quarkus | quarkus | 1.13.3 | <built-in method update of dict object at 0x717bf8fe2300> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:* |
| Yes | cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:* |
| Yes | cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:* |
| Yes | cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:* |
| Yes | cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:quarkus:quarkus:1.13.3:*:*:*:*:*:*:* |