Log in Start free

Vulnerability · Published Feb 25, 2021 · Assigned by mongodb

CVE-2021-20328MongoDB Java driver client-side field level encryption not verifying KMS host name

Medium 6.4

In plain English

A medium-severity improper certificate validation in mongo-java-driver from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.4%top 62.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.mongodb:mongo-java-driver3.11.3GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongo-java-driver3.12.8GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver3.12.8GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver3.11.3GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver-legacy3.11.3GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver-legacy4.0.6GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver-legacy4.1.2GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver-legacy3.12.8GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver-legacy4.2.1GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver-sync4.0.6GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver-sync4.1.2GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver-sync3.12.8GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver-sync3.11.3GHSA-rghw-6px2-fgwc
Mavenorg.mongodb:mongodb-driver-sync4.2.1GHSA-rghw-6px2-fgwc
Ubuntu:22.04:LTSmongo-java-driverno fix listedUBUNTU-CVE-2021-20328
Ubuntu:24.04:LTSmongo-java-driverno fix listedUBUNTU-CVE-2021-20328
Ubuntu:25.10mongo-java-driverno fix listedUBUNTU-CVE-2021-20328
Ubuntu:26.04:LTSmongo-java-driverno fix listedUBUNTU-CVE-2021-20328
Ubuntu:26.10mongo-java-driverno fix listedUBUNTU-CVE-2021-20328

Affected products (as reported)

VendorProductVersions
MongoDB Inc. mongo-java-driver 3.11 – through 3.11.23.12 – through 3.12.7
MongoDB Inc. mongodb-driver 3.11 – through 3.11.23.12 – through 3.12.7
MongoDB Inc. mongodb-driver-sync 4.2.03.11 – through 3.11.23.12 – through 3.12.74.0 – through 4.0.54.1 – through 4.1.1
MongoDB Inc. mongodb-driver-legacy 4.2.03.11 – through 3.11.23.12 – through 3.12.74.0 – through 4.0.54.1 – through 4.1.1

Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References