TLS Certificate Validation Bypass Vulnerability Affects MongoDB Server Versions Prior to 7.0.5, 6.0.13, 5.0.24, and 4.4.28

CVE-2024-1351

Summary

A significant vulnerability exists in MongoDB Server where specific configurations of --tlsCAFile and tls.CAFile can result in skipping peer certificate validation. This misconfiguration permits untrusted connections, which poses a substantial risk to overall security by undermining the efficacy of TLS. If the server is initiated with TLS enabled and the appropriate CAFile setting is not configured, it may allow incoming connections that would otherwise be rejected due to failed certificate validation. This flaw affects multiple versions of MongoDB Server across various releases, emphasizing the critical need for correct TLS configurations to maintain secure operations.

References