USN-5052-1: MongoDB vulnerability

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• mongodb - Document-oriented database

Details

MongoDB would fail to properly invalidate existing sessions for deleted
users. This could allow a remote authenticated attacker to gain elevated
privileges if their user account was recreated with elevated privileges.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• mongodb-server - 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2
• mongodb-clients - 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2
• mongodb-server-core - 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2

Ubuntu 18.04

• mongodb-server - 1:3.6.3-0ubuntu1.3
• mongodb-clients - 1:3.6.3-0ubuntu1.3
• mongodb-server-core - 1:3.6.3-0ubuntu1.3

In general, a standard system update will make all the necessary changes.

References

• CVE-2019-2386