CVE-2024-8013

CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines

State: Published
Severity: 2.2 Low
Published: Oct 28, 2024
Updated: Oct 28, 2024
Reserved: Aug 20, 2024

Description

A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.

Scores

CVSS	Score	Vector	Source
3.1	2.2 Low	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N	mongodb

Weaknesses

CWE-319 Cleartext Transmission of Sensitive Information

Affected Products

Product	Versions
mongocryptdMongoDB Inc	5.0 to before 5.0.29Affected 6.0 to before 6.0.17Affected 7.0 to before 7.012Affected 7.3 to before 7.3.4Affected
Mongo_crypt_v1.soMongoDB Inc	6.0 to before 6.0.17Affected 7.0 to before 7.0.12Affected 7.3 to before 7.3.4Affected

References

https://jira.mongodb.org/browse/SERVER-96254

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.