Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Red Hat Enterprise 6: RHSA-2013:1170-01 Important DoS in MongoDB

red hat
Calendar Grey August 21, 2013
Dist Redhat Esm H88
Both MongoDB and PyMongo have introduced significant enhancements designed to resolve key vulnerabilities for Fedora users.
Updated mongodb and pymongo packages that fix two security issues and add one enhancement are now available for Red Hat Enterprise MRG 2.3 for Red Hat Enterprise Linux 6

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Summary

MongoDB is a NoSQL database. PyMongo provides tools for working with MongoDB.
A flaw was found in the run() function implementation in MongoDB. A database user permitted to send database queries to a MongoDB server could use this flaw to crash the server or, possibly, execute arbitrary code with the privileges of the mongodb user. (CVE-2013-1892)
A NULL pointer dereference flaw was found in PyMongo. An invalid DBRef record received from a MongoDB server could cause an application using PyMongo to crash. (CVE-2013-2132)
Note: In Red Hat Enterprise MRG Grid, MongoDB is not accessed by usersdirectly and is only accessed by other Grid services, such as Condor and Cumin.
This update also adds the following enhancement:
* Previously, MongoDB was configured to listen for connections on all network interfaces. This could allow remote users to access the database if the firewall was configured to allow access to the MongoDB port (access is blocked by the default firewall configuration in Red Hat Enterprise Linux). This update changes the configuration to only listen on the loopback interface by default. (BZ#892767)
Users of Red Hat Enterprise MRG 2.3 for Red Hat Enterprise Linux 6 are advised to upgrade to these updated packages, which contain backported patches to resolve these issues and add this enhancement. After installing this update, MongoDB will be restarted automatically.

Topics%20covered

Topics Covered

security advisory security issue update DoS Red Hat Enterprise MongoDB PyMongo

References

https://access.redhat.com/security/cve/CVE-2013-1892 https://access.redhat.com/security/cve/CVE-2013-2132 https://access.redhat.com/security/updates/classification/#important

Package List

MRG Grid for RHEL 6 Server v.2:
Source:
i386: mongodb-1.6.4-6.el6.i686.rpm mongodb-debuginfo-1.6.4-6.el6.i686.rpm mongodb-server-1.6.4-6.el6.i686.rpm pymongo-1.9-11.el6.i686.rpm pymongo-debuginfo-1.9-11.el6.i686.rpm python-bson-1.9-11.el6.i686.rpm
x86_64: mongodb-1.6.4-6.el6.x86_64.rpm mongodb-debuginfo-1.6.4-6.el6.x86_64.rpm mongodb-server-1.6.4-6.el6.x86_64.rpm pymongo-1.9-11.el6.x86_64.rpm pymongo-debuginfo-1.9-11.el6.x86_64.rpm python-bson-1.9-11.el6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2013:1170-01
Product: Red Hat Enterprise MRG for RHEL-6
Advisory URL: https://access.redhat.com/errata/RHSA-2013:1170.html
Issue date: 2013-08-21

Topic

Updated mongodb and pymongo packages that fix two security issues and addone enhancement are now available for Red Hat Enterprise MRG 2.3 for RedHat Enterprise Linux 6.The Red Hat Security Response Team has rated this update as havingimportant security impact. Common Vulnerability Scoring System (CVSS) basescores, which give detailed severity ratings, are available for eachvulnerability from the CVE links in the References section.

Topics%20covered

Topics Covered

security advisory security issue update DoS Red Hat Enterprise MongoDB PyMongo

Relevant Releases Architectures

MRG Grid for RHEL 6 Server v.2 - i386, x86_64

Bugs Fixed

927536 - CVE-2013-1892 MongoDB: Server Side JavaScript Includes allow Remote Code Execution

969560 - CVE-2013-2132 pymongo: null pointer when decoding invalid DBRef

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here