This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsaid="201611-13">
<title>MongoDB: Denial of Service</title>
<synopsis>A vulnerability in MongoDB can lead to a Denial of Service
condition.
</synopsis>
<producttype="ebuild">mongodb</product>
<announced>2016-11-20</announced>
<revisedcount="1">2016-11-20</revised>
<bug>542880</bug>
<access>remote</access>
<affected>
<packagename="dev-db/mongodb"auto="yes"arch="*">
<unaffectedrange="ge">2.4.13</unaffected>
<vulnerablerange="lt">2.4.13</vulnerable>
</package>
</affected>
<background>
<p>MongoDB (from “humongous”) is a scalable, high-performance, open
source, schema-free, document-oriented database.
</p>
</background>
<description>
<p>MongoDB’s ‘mongod’ server fails to validate some cases of
malformed BSON.
</p>
</description>
<impacttype="normal">
<p>A remote attacker could send a specially crafted BSON request possibly
resulting in a Denial of Service condition.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All MongoDB users should upgrade to the latest version:</p>