CVE-2020-7922

Kubernetes Operator generates potentially insecure certificates

State: Published
Severity: 6.4 Medium
Published: Apr 9, 2020
Updated: Sep 16, 2024
Reserved: Jan 23, 2020

Description

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected. This issue affects MongoDB Enterprise Kubernetes Operator version 1.0, MongoDB Enterprise Kubernetes Operator version 1.1, MongoDB Enterprise Kubernetes Operator version 1.2 versions prior to 1.2.4, MongoDB Enterprise Kubernetes Operator version 1.3 versions prior to 1.3.1, 1.2, 1.4 versions prior to 1.4.4.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N	mongodb

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
MongoDB Enterprise Kubernetes OperatorMongoDB Inc.	1.0Affected 1.1Affected 1.2 through 1.2.4Affected 1.3 through 1.3.1Affected 1.4 through 1.4.4Affected

References

https://github.com/mongodb/mongodb-enterprise-kubernetes/releases/tag/1.2.5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.