Vulnerability report for Docker mongo:6.0.2-focal

Vulnerabilities	202 via 434 paths
Dependencies	154
Source	Docker
Target OS	ubuntu:20.04

Test your Docker Hub image against our market leading vulnerability database Sign up for free

Severity

Critical
High
4
Medium
126
Low
72

Status

Open
202
Patched
0
Ignored
0

high severity

CVE-2023-44487

Vulnerable module: nghttp2/libnghttp2-14
Introduced through: nghttp2/libnghttp2-14@1.40.0-1build1
Fixed in: 1.40.0-1ubuntu0.2

Detailed paths

Introduced through: mongo@6.0.2-focal › nghttp2/libnghttp2-14@1.40.0-1build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream nghttp2 package and not the nghttp2 package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Remediation

Upgrade Ubuntu:20.04 nghttp2 to version 1.40.0-1ubuntu0.2 or higher.

References

CVE-2023-44487 vulnerability report

high severity

Access of Resource Using Incompatible Type ('Type Confusion')

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.17

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.17 or higher.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

high severity

Out-of-bounds Write

Vulnerable module: gnupg2/dirmngr
Introduced through: gnupg2/dirmngr@2.2.19-3ubuntu2.2, gnupg2/gnupg@2.2.19-3ubuntu2.2 and others
Fixed in: 2.2.19-3ubuntu2.5+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › gnupg2/dirmngr@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gnupg@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gnupg-l10n@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gnupg-utils@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpg@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpg-agent@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpg-wks-client@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpg-wks-server@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpgconf@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpgsm@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpgv@2.2.19-3ubuntu2.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

Remediation

Upgrade Ubuntu:20.04 gnupg2 to version 2.2.19-3ubuntu2.5+esm1 or higher.

References

Out-of-bounds Write vulnerability report

high severity

CVE-2026-45447

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm4

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution.

When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition.

In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution.

Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm4 or higher.

References

CVE-2026-45447 vulnerability report

medium severity

Exposure of Resource to Wrong Sphere

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.14

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent POST request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.14 or higher.

References

Exposure of Resource to Wrong Sphere vulnerability report

medium severity

Improper Null Termination

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm2 or higher.

References

Improper Null Termination vulnerability report

medium severity

CVE-2022-44640

Vulnerable module: heimdal/libasn1-8-heimdal
Introduced through: heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1, heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1 and others
Fixed in: 7.7.0+dfsg-1ubuntu1.3

Detailed paths

Introduced through: mongo@6.0.2-focal › heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhcrypto4-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimbase1-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimntlm0-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhx509-5-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libkrb5-26-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libroken18-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libwind0-heimdal@7.7.0+dfsg-1ubuntu1.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream heimdal package and not the heimdal package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).

Remediation

Upgrade Ubuntu:20.04 heimdal to version 7.7.0+dfsg-1ubuntu1.3 or higher.

References

CVE-2022-44640 vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libksba/libksba8
Introduced through: libksba/libksba8@1.3.5-2ubuntu0.20.04.1
Fixed in: 1.3.5-2ubuntu0.20.04.2

Detailed paths

Introduced through: mongo@6.0.2-focal › libksba/libksba8@1.3.5-2ubuntu0.20.04.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libksba package and not the libksba package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.

Remediation

Upgrade Ubuntu:20.04 libksba to version 1.3.5-2ubuntu0.20.04.2 or higher.

References

Integer Overflow or Wraparound vulnerability report

medium severity

CVE-2026-8376

Vulnerable module: perl/perl-base
Introduced through: perl/perl-base@5.30.0-9ubuntu0.3
Fixed in: 5.30.0-9ubuntu0.5+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › perl/perl-base@5.30.0-9ubuntu0.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.

Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.

A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

Remediation

Upgrade Ubuntu:20.04 perl to version 5.30.0-9ubuntu0.5+esm2 or higher.

References

CVE-2026-8376 vulnerability report

medium severity

CVE-2025-6965

Vulnerable module: sqlite3/libsqlite3-0
Introduced through: sqlite3/libsqlite3-0@3.31.1-4ubuntu0.4
Fixed in: 3.31.1-4ubuntu0.7+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › sqlite3/libsqlite3-0@3.31.1-4ubuntu0.4

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.

Remediation

Upgrade Ubuntu:20.04 sqlite3 to version 3.31.1-4ubuntu0.7+esm1 or higher.

References

CVE-2025-6965 vulnerability report

medium severity

Integer Underflow

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm2 or higher.

References

Integer Underflow vulnerability report

medium severity

CVE-2024-37371

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.6

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.6 or higher.

References

CVE-2024-37371 vulnerability report

medium severity

CVE-2026-42496

Vulnerable module: perl/perl-base
Introduced through: perl/perl-base@5.30.0-9ubuntu0.3
Fixed in: 5.30.0-9ubuntu0.5+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › perl/perl-base@5.30.0-9ubuntu0.3

NVD Description

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.

_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.

A subsequent open through the extracted name reads or writes the attacker chosen path.

Remediation

Upgrade Ubuntu:20.04 perl to version 5.30.0-9ubuntu0.5+esm2 or higher.

References

CVE-2026-42496 vulnerability report

medium severity

Improper Validation of Integrity Check Value

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.8

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.8 or higher.

References

Improper Validation of Integrity Check Value vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: heimdal/libasn1-8-heimdal
Introduced through: heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1, heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1 and others
Fixed in: 7.7.0+dfsg-1ubuntu1.3

Detailed paths

Introduced through: mongo@6.0.2-focal › heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhcrypto4-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimbase1-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimntlm0-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhx509-5-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libkrb5-26-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libroken18-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libwind0-heimdal@7.7.0+dfsg-1ubuntu1.1

NVD Description

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

Remediation

Upgrade Ubuntu:20.04 heimdal to version 7.7.0+dfsg-1ubuntu1.3 or higher.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.2

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.2 or higher.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Double Free

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.

This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm1 or higher.

References

Double Free vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm1 or higher.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Improper Validation of Specified Quantity in Input

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm2 or higher.

References

Improper Validation of Specified Quantity in Input vulnerability report

medium severity

new

Improper Validation of Specified Quantity in Input

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm3 or higher.

References

Improper Validation of Specified Quantity in Input vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: perl/perl-base
Introduced through: perl/perl-base@5.30.0-9ubuntu0.3
Fixed in: 5.30.0-9ubuntu0.4

Detailed paths

Introduced through: mongo@6.0.2-focal › perl/perl-base@5.30.0-9ubuntu0.3

NVD Description

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

Remediation

Upgrade Ubuntu:20.04 perl to version 5.30.0-9ubuntu0.4 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: ncurses/libncurses6
Introduced through: ncurses/libncurses6@6.2-0ubuntu2, ncurses/libncursesw6@6.2-0ubuntu2 and others
Fixed in: 6.2-0ubuntu2.1

Detailed paths

Introduced through: mongo@6.0.2-focal › ncurses/libncurses6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/libncursesw6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/libtinfo6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/ncurses-base@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/ncurses-bin@6.2-0ubuntu2

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Remediation

Upgrade Ubuntu:20.04 ncurses to version 6.2-0ubuntu2.1 or higher.

References

Out-of-bounds Write vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: perl/perl-base
Introduced through: perl/perl-base@5.30.0-9ubuntu0.3
Fixed in: 5.30.0-9ubuntu0.5

Detailed paths

Introduced through: mongo@6.0.2-focal › perl/perl-base@5.30.0-9ubuntu0.3

NVD Description

A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.

Remediation

Upgrade Ubuntu:20.04 perl to version 5.30.0-9ubuntu0.5 or higher.

References

Out-of-bounds Write vulnerability report

medium severity

Insufficient Verification of Data Authenticity

Vulnerable module: ca-certificates
Introduced through: ca-certificates@20211016~20.04.1
Fixed in: 20211016ubuntu0.20.04.1

Detailed paths

Introduced through: mongo@6.0.2-focal › ca-certificates@20211016~20.04.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream ca-certificates package and not the ca-certificates package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Remediation

Upgrade Ubuntu:20.04 ca-certificates to version 20211016ubuntu0.20.04.1 or higher.

References

Insufficient Verification of Data Authenticity vulnerability report

medium severity

Improper Handling of Length Parameter Inconsistency

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm2 or higher.

References

Improper Handling of Length Parameter Inconsistency vulnerability report

medium severity

Information Exposure

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.10

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.10 or higher.

References

Information Exposure vulnerability report

medium severity

Undefined Behavior for Input to API

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm2 or higher.

References

Undefined Behavior for Input to API vulnerability report

medium severity

Improper Validation of Integrity Check Value

Vulnerable module: heimdal/libasn1-8-heimdal
Introduced through: heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1, heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1 and others
Fixed in: 7.7.0+dfsg-1ubuntu1.4

Detailed paths

Introduced through: mongo@6.0.2-focal › heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhcrypto4-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimbase1-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimntlm0-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhx509-5-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libkrb5-26-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libroken18-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libwind0-heimdal@7.7.0+dfsg-1ubuntu1.1

NVD Description

The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.

Remediation

Upgrade Ubuntu:20.04 heimdal to version 7.7.0+dfsg-1ubuntu1.4 or higher.

References

Improper Validation of Integrity Check Value vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: heimdal/libasn1-8-heimdal
Introduced through: heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1, heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1 and others
Fixed in: 7.7.0+dfsg-1ubuntu1.3

Detailed paths

Introduced through: mongo@6.0.2-focal › heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhcrypto4-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimbase1-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimntlm0-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhx509-5-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libkrb5-26-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libroken18-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libwind0-heimdal@7.7.0+dfsg-1ubuntu1.1

NVD Description

Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept.

Remediation

Upgrade Ubuntu:20.04 heimdal to version 7.7.0+dfsg-1ubuntu1.3 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Off-by-one Error

Vulnerable module: heimdal/libasn1-8-heimdal
Introduced through: heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1, heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1 and others
Fixed in: 7.7.0+dfsg-1ubuntu1.2

Detailed paths

Introduced through: mongo@6.0.2-focal › heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhcrypto4-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimbase1-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimntlm0-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhx509-5-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libkrb5-26-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libroken18-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libwind0-heimdal@7.7.0+dfsg-1ubuntu1.1

NVD Description

Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.

Remediation

Upgrade Ubuntu:20.04 heimdal to version 7.7.0+dfsg-1ubuntu1.2 or higher.

References

Off-by-one Error vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1
Fixed in: 1.6-1ubuntu0.20.04.1+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream jq package and not the jq package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.

Remediation

Upgrade Ubuntu:20.04 jq to version 1.6-1ubuntu0.20.04.1+esm2 or higher.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1
Fixed in: 1.6-1ubuntu0.20.04.1+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void* p = malloc(sz);. As of time of publication, no patched versions are available.

Remediation

Upgrade Ubuntu:20.04 jq to version 1.6-1ubuntu0.20.04.1+esm1 or higher.

References

Out-of-bounds Write vulnerability report

medium severity

CVE-2024-37370

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.6

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.6 or higher.

References

CVE-2024-37370 vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.3

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.3 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm4

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm4 or higher.

References

Out-of-Bounds vulnerability report

medium severity

Improper Enforcement of Message or Data Structure

Vulnerable module: nghttp2/libnghttp2-14
Introduced through: nghttp2/libnghttp2-14@1.40.0-1build1
Fixed in: 1.40.0-1ubuntu0.1

Detailed paths

Introduced through: mongo@6.0.2-focal › nghttp2/libnghttp2-14@1.40.0-1build1

NVD Description

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

Remediation

Upgrade Ubuntu:20.04 nghttp2 to version 1.40.0-1ubuntu0.1 or higher.

References

Improper Enforcement of Message or Data Structure vulnerability report

medium severity

Double Free

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.17

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack.

The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected.

These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0.

The OpenSSL asn1parse command line application is also impacted by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.17 or higher.

References

Double Free vulnerability report

medium severity

Use After Free

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.17

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.

The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash.

This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.

Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream.

The OpenSSL cms and smime command line applications are similarly affected.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.17 or higher.

References

Use After Free vulnerability report

medium severity

Improper Validation of Array Index

Vulnerable module: sqlite3/libsqlite3-0
Introduced through: sqlite3/libsqlite3-0@3.31.1-4ubuntu0.4
Fixed in: 3.31.1-4ubuntu0.5

Detailed paths

Introduced through: mongo@6.0.2-focal › sqlite3/libsqlite3-0@3.31.1-4ubuntu0.4

NVD Description

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Remediation

Upgrade Ubuntu:20.04 sqlite3 to version 3.31.1-4ubuntu0.5 or higher.

References

Improper Validation of Array Index vulnerability report

medium severity

new

Improper Certificate Validation

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm3 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

Improper Handling of Case Sensitivity

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm2 or higher.

References

Improper Handling of Case Sensitivity vulnerability report

medium severity

Information Exposure

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.8

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.8 or higher.

References

Information Exposure vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: sqlite3/libsqlite3-0
Introduced through: sqlite3/libsqlite3-0@3.31.1-4ubuntu0.4
Fixed in: 3.31.1-4ubuntu0.6

Detailed paths

Introduced through: mongo@6.0.2-focal › sqlite3/libsqlite3-0@3.31.1-4ubuntu0.4

NVD Description

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.

Remediation

Upgrade Ubuntu:20.04 sqlite3 to version 3.31.1-4ubuntu0.6 or higher.

References

Out-of-Bounds vulnerability report

medium severity

new

Improper Certificate Validation

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm3 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

new

Expired Pointer Dereference

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in GnuTLS. The gnutls_pkcs11_token_set_pin function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm3 or higher.

References

Expired Pointer Dereference vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.16

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.16 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

CVE-2023-46218

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.21

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.

It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL used a lower case hostname curl.co.uk, even though co.uk is listed as a PSL domain.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.21 or higher.

References

CVE-2023-46218 vulnerability report

medium severity

Insufficient Session Expiration

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm5

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials.

An application that first uses Negotiate authentication to a server with user1:password1 and then does another operation to the same server asking for any authentication method but for user2:password2 (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm5 or higher.

References

Insufficient Session Expiration vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.23

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

libcurl's ASN1 parser code has the GTime2str() function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a strlen() getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.

This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when CURLINFO_CERTINFO is used.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.23 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm1 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: heimdal/libasn1-8-heimdal
Introduced through: heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1, heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1 and others
Fixed in: 7.7.0+dfsg-1ubuntu1.3

Detailed paths

Introduced through: mongo@6.0.2-focal › heimdal/libasn1-8-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libgssapi3-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhcrypto4-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimbase1-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libheimntlm0-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libhx509-5-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libkrb5-26-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libroken18-heimdal@7.7.0+dfsg-1ubuntu1.1
Introduced through: mongo@6.0.2-focal › heimdal/libwind0-heimdal@7.7.0+dfsg-1ubuntu1.1

NVD Description

A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

Remediation

Upgrade Ubuntu:20.04 heimdal to version 7.7.0+dfsg-1ubuntu1.3 or higher.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1
Fixed in: 1.6-1ubuntu0.20.04.1+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

Remediation

Upgrade Ubuntu:20.04 jq to version 1.6-1ubuntu0.20.04.1+esm2 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

Access of Uninitialized Pointer

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.4

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.4 or higher.

References

Access of Uninitialized Pointer vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.3

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.3 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Improper Authentication

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.3

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepki_verify_data_signature function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value rc, which is initialized to SSH_ERROR and later rewritten to save the return value of the function call pki_key_check_hash_compatible. The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls goto error returning SSH_OK.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.3 or higher.

References

Improper Authentication vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.3

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.3 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.19

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow.

Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service.

An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods.

When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*).

With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms.

Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data.

Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low.

In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature.

The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication.

In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.19 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Directory Traversal

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences.

This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm3 or higher.

References

Directory Traversal vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: p11-kit/libp11-kit0
Introduced through: p11-kit/libp11-kit0@0.23.20-1ubuntu0.1

Detailed paths

Introduced through: mongo@6.0.2-focal › p11-kit/libp11-kit0@0.23.20-1ubuntu0.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit package and not the p11-kit package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Remediation

There is no fixed version for Ubuntu:20.04 p11-kit.

References

Uncontrolled Recursion vulnerability report

medium severity

Improper Authentication

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.18

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.18 or higher.

References

Improper Authentication vulnerability report

medium severity

Use After Free

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.15

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.15 or higher.

References

Use After Free vulnerability report

medium severity

Information Exposure

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.9

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.9 or higher.

References

Information Exposure vulnerability report

medium severity

Reversible One-Way Hash

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.11

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.11 or higher.

References

Reversible One-Way Hash vulnerability report

medium severity

Improper Validation of Integrity Check Value

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.4

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.4 or higher.

References

Improper Validation of Integrity Check Value vulnerability report

medium severity

Information Exposure

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.17

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.

For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.17 or higher.

References

Information Exposure vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.

Remediation

There is no fixed version for Ubuntu:20.04 jq.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1
Fixed in: 1.6-1ubuntu0.20.04.1+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~~65,000 integers (~~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.

Remediation

Upgrade Ubuntu:20.04 jq to version 1.6-1ubuntu0.20.04.1+esm2 or higher.

References

Uncontrolled Recursion vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.

Remediation

There is no fixed version for Ubuntu:20.04 jq.

References

Uncontrolled Recursion vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.

Remediation

There is no fixed version for Ubuntu:20.04 jq.

References

Uncontrolled Recursion vulnerability report

medium severity

Inefficient Regular Expression Complexity

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the match_pattern() function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm3 or higher.

References

Inefficient Regular Expression Complexity vulnerability report

medium severity

CVE-2024-22365

Vulnerable module: pam/libpam-modules
Introduced through: pam/libpam-modules@1.3.1-5ubuntu4.3, pam/libpam-modules-bin@1.3.1-5ubuntu4.3 and others
Fixed in: 1.3.1-5ubuntu4.7

Detailed paths

Introduced through: mongo@6.0.2-focal › pam/libpam-modules@1.3.1-5ubuntu4.3
Introduced through: mongo@6.0.2-focal › pam/libpam-modules-bin@1.3.1-5ubuntu4.3
Introduced through: mongo@6.0.2-focal › pam/libpam-runtime@1.3.1-5ubuntu4.3
Introduced through: mongo@6.0.2-focal › pam/libpam0g@1.3.1-5ubuntu4.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam package and not the pam package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

Remediation

Upgrade Ubuntu:20.04 pam to version 1.3.1-5ubuntu4.7 or higher.

References

CVE-2024-22365 vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: sqlite3/libsqlite3-0
Introduced through: sqlite3/libsqlite3-0@3.31.1-4ubuntu0.4
Fixed in: 3.31.1-4ubuntu0.7

Detailed paths

Introduced through: mongo@6.0.2-focal › sqlite3/libsqlite3-0@3.31.1-4ubuntu0.4

NVD Description

In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.

Remediation

Upgrade Ubuntu:20.04 sqlite3 to version 3.31.1-4ubuntu0.7 or higher.

References

Integer Overflow or Wraparound vulnerability report

medium severity

CVE-2022-4415

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@245.4-4ubuntu3.18 and systemd/libudev1@245.4-4ubuntu3.18
Fixed in: 245.4-4ubuntu3.20

Detailed paths

Introduced through: mongo@6.0.2-focal › systemd/libsystemd0@245.4-4ubuntu3.18
Introduced through: mongo@6.0.2-focal › systemd/libudev1@245.4-4ubuntu3.18

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.

Remediation

Upgrade Ubuntu:20.04 systemd to version 245.4-4ubuntu3.20 or higher.

References

CVE-2022-4415 vulnerability report

medium severity

Off-by-one Error

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@245.4-4ubuntu3.18 and systemd/libudev1@245.4-4ubuntu3.18
Fixed in: 245.4-4ubuntu3.20

Detailed paths

Introduced through: mongo@6.0.2-focal › systemd/libsystemd0@245.4-4ubuntu3.18
Introduced through: mongo@6.0.2-focal › systemd/libudev1@245.4-4ubuntu3.18

NVD Description

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

Remediation

Upgrade Ubuntu:20.04 systemd to version 245.4-4ubuntu3.20 or higher.

References

Off-by-one Error vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: tar
Introduced through: tar@1.30+dfsg-7ubuntu0.20.04.2
Fixed in: 1.30+dfsg-7ubuntu0.20.04.3

Detailed paths

Introduced through: mongo@6.0.2-focal › tar@1.30+dfsg-7ubuntu0.20.04.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

Remediation

Upgrade Ubuntu:20.04 tar to version 1.30+dfsg-7ubuntu0.20.04.3 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

Unrestricted Upload of File with Dangerous Type

Vulnerable module: tar
Introduced through: tar@1.30+dfsg-7ubuntu0.20.04.2
Fixed in: 1.30+dfsg-7ubuntu0.20.04.4+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › tar@1.30+dfsg-7ubuntu0.20.04.2

NVD Description

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Remediation

Upgrade Ubuntu:20.04 tar to version 1.30+dfsg-7ubuntu0.20.04.4+esm3 or higher.

References

Unrestricted Upload of File with Dangerous Type vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm1 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

new

Authentication Bypass

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm5

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

Successfully using libcurl to do a transfer over a specific HTTP proxy (proxyA) with Digest authentication and then changing the proxy host to a second one (proxyB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Proxy-Authorization: header field meant for proxyA, to proxyB.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm5 or higher.

References

Authentication Bypass vulnerability report

medium severity

Algorithmic Complexity

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm2 or higher.

References

Algorithmic Complexity vulnerability report

medium severity

Algorithmic Complexity

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12 or higher.

References

Algorithmic Complexity vulnerability report

medium severity

new

Off-by-one Error

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm3 or higher.

References

Off-by-one Error vulnerability report

medium severity

Improper Input Validation

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1
Fixed in: 1.6-1ubuntu0.20.04.1+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Remediation

Upgrade Ubuntu:20.04 jq to version 1.6-1ubuntu0.20.04.1+esm2 or higher.

References

Improper Input Validation vulnerability report

medium severity

Unchecked Return Value

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5 or higher.

References

Unchecked Return Value vulnerability report

medium severity

Algorithmic Complexity

Vulnerable module: libtasn1-6
Introduced through: libtasn1-6@4.16.0-2
Fixed in: 4.16.0-2ubuntu0.1

Detailed paths

Introduced through: mongo@6.0.2-focal › libtasn1-6@4.16.0-2

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtasn1-6 package and not the libtasn1-6 package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.

Remediation

Upgrade Ubuntu:20.04 libtasn1-6 to version 4.16.0-2ubuntu0.1 or higher.

References

Algorithmic Complexity vulnerability report

medium severity

Arbitrary Code Injection

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5 or higher.

References

Arbitrary Code Injection vulnerability report

medium severity

CVE-2025-30258

Vulnerable module: gnupg2/dirmngr
Introduced through: gnupg2/dirmngr@2.2.19-3ubuntu2.2, gnupg2/gnupg@2.2.19-3ubuntu2.2 and others
Fixed in: 2.2.19-3ubuntu2.4

Detailed paths

Introduced through: mongo@6.0.2-focal › gnupg2/dirmngr@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gnupg@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gnupg-l10n@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gnupg-utils@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpg@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpg-agent@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpg-wks-client@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpg-wks-server@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpgconf@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpgsm@2.2.19-3ubuntu2.2
Introduced through: mongo@6.0.2-focal › gnupg2/gpgv@2.2.19-3ubuntu2.2

NVD Description

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

Remediation

Upgrade Ubuntu:20.04 gnupg2 to version 2.2.19-3ubuntu2.4 or higher.

References

CVE-2025-30258 vulnerability report

medium severity

Race Condition

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@245.4-4ubuntu3.18 and systemd/libudev1@245.4-4ubuntu3.18
Fixed in: 245.4-4ubuntu3.24+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › systemd/libsystemd0@245.4-4ubuntu3.18
Introduced through: mongo@6.0.2-focal › systemd/libudev1@245.4-4ubuntu3.18

NVD Description

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.

A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

Remediation

Upgrade Ubuntu:20.04 systemd to version 245.4-4ubuntu3.24+esm1 or higher.

References

Race Condition vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm1 or higher.

References

Out-of-bounds Write vulnerability report

medium severity

Use After Free

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm1 or higher.

References

Use After Free vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm3 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

CVE-2024-8096

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.24

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.24 or higher.

References

CVE-2024-8096 vulnerability report

medium severity

CVE-2025-14017

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.

Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm2 or higher.

References

CVE-2025-14017 vulnerability report

medium severity

CVE-2026-11856

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

Remediation

There is no fixed version for Ubuntu:20.04 curl.

References

CVE-2026-11856 vulnerability report

medium severity

CVE-2026-1965

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates connections and not requests, contrary to how HTTP is designed to work.

An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with user1:password1 and then does another operation to the same server also using Negotiate but with user2:password2 (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1...

The set of authentication methods to use is set with CURLOPT_HTTPAUTH.

Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: CURLOPT_FRESH_CONNECT, CURLOPT_MAXCONNECTS and CURLMOPT_MAX_HOST_CONNECTIONS (if using the curl_multi API).

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm3 or higher.

References

CVE-2026-1965 vulnerability report

medium severity

CVE-2026-3783

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances.

If the hostname that the first request is redirected to has information in the used .netrc file, with either of the machine or default keywords, curl would pass on the bearer token set for the first host also to the second one.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm3 or higher.

References

CVE-2026-3783 vulnerability report

medium severity

CVE-2026-8927

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm4

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm4 or higher.

References

CVE-2026-8927 vulnerability report

medium severity

Insufficiently Protected Credentials

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

curl might erroneously pass on credentials for a first proxy to a second proxy.

This can happen when the following conditions are true:

curl is setup to use specific different proxies for different URL schemes
the first proxy needs credentials
the second proxy uses no credentials
while using the first proxy (using say http://), curl is asked to follow a redirect to a URL using another scheme (say https://), accessed using a second, different, proxy

Remediation

There is no fixed version for Ubuntu:20.04 curl.

References

Insufficiently Protected Credentials vulnerability report

medium severity

Missing Release of Resource after Effective Lifetime

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.22

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.22 or higher.

References

Missing Release of Resource after Effective Lifetime vulnerability report

medium severity

CVE-2024-2961

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.15

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.15 or higher.

References

CVE-2024-2961 vulnerability report

medium severity

CVE-2024-33599

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.16

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

nscd: Stack-based buffer overflow in netgroup cache

If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.16 or higher.

References

CVE-2024-33599 vulnerability report

medium severity

CVE-2024-33600

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.16

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

nscd: Null pointer crashes after notfound response

If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.16 or higher.

References

CVE-2024-33600 vulnerability report

medium severity

CVE-2024-33601

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.16

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

nscd: netgroup cache may terminate daemon on memory allocation failure

The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.16 or higher.

References

CVE-2024-33601 vulnerability report

medium severity

CVE-2024-33602

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.16

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings

The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.16 or higher.

References

CVE-2024-33602 vulnerability report

medium severity

CVE-2025-0395

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.17

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.17 or higher.

References

CVE-2025-0395 vulnerability report

medium severity

CVE-2025-15281

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.18+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.18+esm1 or higher.

References

CVE-2025-15281 vulnerability report

medium severity

CVE-2025-4802

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.18

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.18 or higher.

References

CVE-2025-4802 vulnerability report

medium severity

CVE-2025-8058

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.18+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.18+esm1 or higher.

References

CVE-2025-8058 vulnerability report

medium severity

CVE-2026-0861

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.18+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.

Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.18+esm1 or higher.

References

CVE-2026-0861 vulnerability report

medium severity

CVE-2026-0915

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.18+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.18+esm1 or higher.

References

CVE-2026-0915 vulnerability report

medium severity

CVE-2026-4046

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

Remediation

There is no fixed version for Ubuntu:20.04 glibc.

References

CVE-2026-4046 vulnerability report

medium severity

CVE-2026-5435

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.

Remediation

There is no fixed version for Ubuntu:20.04 glibc.

References

CVE-2026-5435 vulnerability report

medium severity

CVE-2026-6238

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.

These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.

Remediation

There is no fixed version for Ubuntu:20.04 glibc.

References

CVE-2026-6238 vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.11

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.11 or higher.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Improper Input Validation

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.

Remediation

There is no fixed version for Ubuntu:20.04 jq.

References

Improper Input Validation vulnerability report

medium severity

Improper Neutralization of Null Byte or NUL Character

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.

Remediation

There is no fixed version for Ubuntu:20.04 jq.

References

Improper Neutralization of Null Byte or NUL Character vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1
Fixed in: 1.6-1ubuntu0.20.04.1+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03.

Remediation

Upgrade Ubuntu:20.04 jq to version 1.6-1ubuntu0.20.04.1+esm2 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

Reversible One-Way Hash

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1
Fixed in: 1.6-1ubuntu0.20.04.1+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.

Remediation

Upgrade Ubuntu:20.04 jq to version 1.6-1ubuntu0.20.04.1+esm2 or higher.

References

Reversible One-Way Hash vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.9

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.9 or higher.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: libtasn1-6
Introduced through: libtasn1-6@4.16.0-2
Fixed in: 4.16.0-2ubuntu0.1+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › libtasn1-6@4.16.0-2

NVD Description

Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.

Remediation

Upgrade Ubuntu:20.04 libtasn1-6 to version 4.16.0-2ubuntu0.1+esm1 or higher.

References

Out-of-bounds Write vulnerability report

medium severity

CVE-2024-28182

Vulnerable module: nghttp2/libnghttp2-14
Introduced through: nghttp2/libnghttp2-14@1.40.0-1build1
Fixed in: 1.40.0-1ubuntu0.3

Detailed paths

Introduced through: mongo@6.0.2-focal › nghttp2/libnghttp2-14@1.40.0-1build1

NVD Description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

Remediation

Upgrade Ubuntu:20.04 nghttp2 to version 1.40.0-1ubuntu0.3 or higher.

References

CVE-2024-28182 vulnerability report

medium severity

Reachable Assertion

Vulnerable module: nghttp2/libnghttp2-14
Introduced through: nghttp2/libnghttp2-14@1.40.0-1build1
Fixed in: 1.40.0-1ubuntu0.3+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › nghttp2/libnghttp2-14@1.40.0-1build1

NVD Description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Remediation

Upgrade Ubuntu:20.04 nghttp2 to version 1.40.0-1ubuntu0.3+esm1 or higher.

References

Reachable Assertion vulnerability report

medium severity

CVE-2025-9230

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write.

Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code.

Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm1 or higher.

References

CVE-2025-9230 vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: sed
Introduced through: sed@4.7-1
Fixed in: 4.7-1ubuntu0.1~esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › sed@4.7-1

NVD Description

Note: Versions mentioned in the description apply only to the upstream sed package and not the sed package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path:

resolves symlink to its target and stores the resolved path for determining when output is written,
opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.

This issue was fixed in version 4.10.

Remediation

Upgrade Ubuntu:20.04 sed to version 4.7-1ubuntu0.1~esm1 or higher.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

CVE-2025-52099

Vulnerable module: sqlite3/libsqlite3-0
Introduced through: sqlite3/libsqlite3-0@3.31.1-4ubuntu0.4
Fixed in: 3.31.1-4ubuntu0.7

Detailed paths

Introduced through: mongo@6.0.2-focal › sqlite3/libsqlite3-0@3.31.1-4ubuntu0.4

NVD Description

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-29088. Reason: This record is a duplicate of CVE-2025-29088. Notes: All CVE users should reference CVE-2025-29088 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.

Remediation

Upgrade Ubuntu:20.04 sqlite3 to version 3.31.1-4ubuntu0.7 or higher.

References

CVE-2025-52099 vulnerability report

medium severity

Improper Privilege Management

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@245.4-4ubuntu3.18 and systemd/libudev1@245.4-4ubuntu3.18
Fixed in: 245.4-4ubuntu3.24+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › systemd/libsystemd0@245.4-4ubuntu3.18
Introduced through: mongo@6.0.2-focal › systemd/libudev1@245.4-4ubuntu3.18

NVD Description

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

Remediation

Upgrade Ubuntu:20.04 systemd to version 245.4-4ubuntu3.24+esm3 or higher.

References

Improper Privilege Management vulnerability report

medium severity

Incorrect Resource Transfer Between Spheres

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@245.4-4ubuntu3.18 and systemd/libudev1@245.4-4ubuntu3.18
Fixed in: 245.4-4ubuntu3.24+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › systemd/libsystemd0@245.4-4ubuntu3.18
Introduced through: mongo@6.0.2-focal › systemd/libudev1@245.4-4ubuntu3.18

NVD Description

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Remediation

Upgrade Ubuntu:20.04 systemd to version 245.4-4ubuntu3.24+esm3 or higher.

References

Incorrect Resource Transfer Between Spheres vulnerability report

medium severity

CVE-2023-39804

Vulnerable module: tar
Introduced through: tar@1.30+dfsg-7ubuntu0.20.04.2
Fixed in: 1.30+dfsg-7ubuntu0.20.04.4

Detailed paths

Introduced through: mongo@6.0.2-focal › tar@1.30+dfsg-7ubuntu0.20.04.2

NVD Description

In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.

Remediation

Upgrade Ubuntu:20.04 tar to version 1.30+dfsg-7ubuntu0.20.04.4 or higher.

References

CVE-2023-39804 vulnerability report

medium severity

Directory Traversal

Vulnerable module: tar
Introduced through: tar@1.30+dfsg-7ubuntu0.20.04.2

Detailed paths

Introduced through: mongo@6.0.2-focal › tar@1.30+dfsg-7ubuntu0.20.04.2

NVD Description

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

Remediation

There is no fixed version for Ubuntu:20.04 tar.

References

Directory Traversal vulnerability report

medium severity

CVE-2024-28085

Vulnerable module: util-linux
Introduced through: util-linux@2.34-0.1ubuntu9.3, util-linux/fdisk@2.34-0.1ubuntu9.3 and others
Fixed in: 2.34-0.1ubuntu9.6

Detailed paths

Introduced through: mongo@6.0.2-focal › util-linux@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/fdisk@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/libblkid1@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/libfdisk1@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/libmount1@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/libsmartcols1@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/libuuid1@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/mount@2.34-0.1ubuntu9.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.

Remediation

Upgrade Ubuntu:20.04 util-linux to version 2.34-0.1ubuntu9.6 or higher.

References

CVE-2024-28085 vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: util-linux
Introduced through: util-linux@2.34-0.1ubuntu9.3, util-linux/bsdutils@1:2.34-0.1ubuntu9.3 and others

Detailed paths

Introduced through: mongo@6.0.2-focal › util-linux@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/bsdutils@1:2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/fdisk@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/libblkid1@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/libfdisk1@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/libmount1@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/libsmartcols1@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/libuuid1@2.34-0.1ubuntu9.3
Introduced through: mongo@6.0.2-focal › util-linux/mount@2.34-0.1ubuntu9.3

NVD Description

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

Remediation

There is no fixed version for Ubuntu:20.04 util-linux.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

low severity

Improper Authentication

Vulnerable module: pam/libpam-modules
Introduced through: pam/libpam-modules@1.3.1-5ubuntu4.3, pam/libpam-modules-bin@1.3.1-5ubuntu4.3 and others
Fixed in: 1.3.1-5ubuntu4.4

Detailed paths

Introduced through: mongo@6.0.2-focal › pam/libpam-modules@1.3.1-5ubuntu4.3
Introduced through: mongo@6.0.2-focal › pam/libpam-modules-bin@1.3.1-5ubuntu4.3
Introduced through: mongo@6.0.2-focal › pam/libpam-runtime@1.3.1-5ubuntu4.3
Introduced through: mongo@6.0.2-focal › pam/libpam0g@1.3.1-5ubuntu4.3

NVD Description

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.

Remediation

Upgrade Ubuntu:20.04 pam to version 1.3.1-5ubuntu4.4 or higher.

References

Improper Authentication vulnerability report

low severity

Off-by-one Error

Vulnerable module: libtasn1-6
Introduced through: libtasn1-6@4.16.0-2
Fixed in: 4.16.0-2ubuntu0.1+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › libtasn1-6@4.16.0-2

NVD Description

GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.

Remediation

Upgrade Ubuntu:20.04 libtasn1-6 to version 4.16.0-2ubuntu0.1+esm1 or higher.

References

Off-by-one Error vulnerability report

low severity

Arbitrary Code Injection

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.18

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.18 or higher.

References

Arbitrary Code Injection vulnerability report

low severity

Directory Traversal

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.18

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde () character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /2/foo while accessing a server with a specific user.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.18 or higher.

References

Directory Traversal vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: ncurses/libncurses6
Introduced through: ncurses/libncurses6@6.2-0ubuntu2, ncurses/libncursesw6@6.2-0ubuntu2 and others
Fixed in: 6.2-0ubuntu2.1

Detailed paths

Introduced through: mongo@6.0.2-focal › ncurses/libncurses6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/libncursesw6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/libtinfo6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/ncurses-base@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/ncurses-bin@6.2-0ubuntu2

NVD Description

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Remediation

Upgrade Ubuntu:20.04 ncurses to version 6.2-0ubuntu2.1 or higher.

References

Out-of-bounds Write vulnerability report

low severity

Buffer Underflow

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A flaw was found in libssh. The API function ssh_get_hexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSH_LOG_PACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm3 or higher.

References

Buffer Underflow vulnerability report

low severity

CVE-2026-28387

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side.

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code.

However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage.

By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.

The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records.

No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm3 or higher.

References

CVE-2026-28387 vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: ncurses/libncurses6
Introduced through: ncurses/libncurses6@6.2-0ubuntu2, ncurses/libncursesw6@6.2-0ubuntu2 and others
Fixed in: 6.2-0ubuntu2.1+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › ncurses/libncurses6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/libncursesw6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/libtinfo6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/ncurses-base@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/ncurses-bin@6.2-0ubuntu2

NVD Description

The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.

Remediation

Upgrade Ubuntu:20.04 ncurses to version 6.2-0ubuntu2.1+esm1 or higher.

References

Stack-based Buffer Overflow vulnerability report

low severity

CVE-2023-26604

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@245.4-4ubuntu3.18 and systemd/libudev1@245.4-4ubuntu3.18

Detailed paths

Introduced through: mongo@6.0.2-focal › systemd/libsystemd0@245.4-4ubuntu3.18
Introduced through: mongo@6.0.2-focal › systemd/libudev1@245.4-4ubuntu3.18

NVD Description

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Remediation

There is no fixed version for Ubuntu:20.04 systemd.

References

CVE-2023-26604 vulnerability report

low severity

Server-Side Request Forgery (SSRF)

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm5

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should.

This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm5 or higher.

References

Server-Side Request Forgery (SSRF) vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: openldap/libldap-2.4-2
Introduced through: openldap/libldap-2.4-2@2.4.49+dfsg-2ubuntu1.9 and openldap/libldap-common@2.4.49+dfsg-2ubuntu1.9
Fixed in: 2.4.49+dfsg-2ubuntu1.10

Detailed paths

Introduced through: mongo@6.0.2-focal › openldap/libldap-2.4-2@2.4.49+dfsg-2ubuntu1.9
Introduced through: mongo@6.0.2-focal › openldap/libldap-common@2.4.49+dfsg-2ubuntu1.9

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

Remediation

Upgrade Ubuntu:20.04 openldap to version 2.4.49+dfsg-2ubuntu1.10 or higher.

References

NULL Pointer Dereference vulnerability report

low severity

CVE-2025-69421

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function.

Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files.

The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure.

Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm2 or higher.

References

CVE-2025-69421 vulnerability report

low severity

CVE-2026-28388

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.

Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.

When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.

Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.

The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm3 or higher.

References

CVE-2026-28388 vulnerability report

low severity

CVE-2026-28389

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.

When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm3 or higher.

References

CVE-2026-28389 vulnerability report

low severity

CVE-2026-28390

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.

When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm3 or higher.

References

CVE-2026-28390 vulnerability report

low severity

Improper Certificate Validation

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.18

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

A security vulnerability has been identified in all supported versions

of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems.

Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.18 or higher.

References

Improper Certificate Validation vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: pcre2/libpcre2-8-0
Introduced through: pcre2/libpcre2-8-0@10.34-7ubuntu0.1

Detailed paths

Introduced through: mongo@6.0.2-focal › pcre2/libpcre2-8-0@10.34-7ubuntu0.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Remediation

There is no fixed version for Ubuntu:20.04 pcre2.

References

Integer Overflow or Wraparound vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: ncurses/libncurses6
Introduced through: ncurses/libncurses6@6.2-0ubuntu2, ncurses/libncursesw6@6.2-0ubuntu2 and others
Fixed in: 6.2-0ubuntu2.1

Detailed paths

Introduced through: mongo@6.0.2-focal › ncurses/libncurses6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/libncursesw6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/libtinfo6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/ncurses-base@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/ncurses-bin@6.2-0ubuntu2

NVD Description

ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.

Remediation

Upgrade Ubuntu:20.04 ncurses to version 6.2-0ubuntu2.1 or higher.

References

Out-of-bounds Read vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: jq
Introduced through: jq@1.6-1ubuntu0.20.04.1 and jq/libjq1@1.6-1ubuntu0.20.04.1
Fixed in: 1.6-1ubuntu0.20.04.1+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › jq@1.6-1ubuntu0.20.04.1
Introduced through: mongo@6.0.2-focal › jq/libjq1@1.6-1ubuntu0.20.04.1

NVD Description

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.

Remediation

Upgrade Ubuntu:20.04 jq to version 1.6-1ubuntu0.20.04.1+esm1 or higher.

References

Integer Overflow or Wraparound vulnerability report

low severity

CVE-2023-50495

Vulnerable module: ncurses/libncurses6
Introduced through: ncurses/libncurses6@6.2-0ubuntu2, ncurses/libncursesw6@6.2-0ubuntu2 and others

Detailed paths

Introduced through: mongo@6.0.2-focal › ncurses/libncurses6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/libncursesw6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/libtinfo6@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/ncurses-base@6.2-0ubuntu2
Introduced through: mongo@6.0.2-focal › ncurses/ncurses-bin@6.2-0ubuntu2

NVD Description

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().

Remediation

There is no fixed version for Ubuntu:20.04 ncurses.

References

CVE-2023-50495 vulnerability report

low severity

Improper Authentication

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.18

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.18 or higher.

References

Improper Authentication vulnerability report

low severity

Improper Certificate Validation

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.19

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with xn-- and should not be allowed to pattern match, but the wildcard check in curl could still check for x*, which would match even though the IDN name most likely contained nothing even resembling an x.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.19 or higher.

References

Improper Certificate Validation vulnerability report

low severity

Use After Free

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.14

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.14 or higher.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.31-0ubuntu9.9 and glibc/libc6@2.31-0ubuntu9.9
Fixed in: 2.31-0ubuntu9.14

Detailed paths

Introduced through: mongo@6.0.2-focal › glibc/libc-bin@2.31-0ubuntu9.9
Introduced through: mongo@6.0.2-focal › glibc/libc6@2.31-0ubuntu9.9

NVD Description

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

Remediation

Upgrade Ubuntu:20.04 glibc to version 2.31-0ubuntu9.14 or higher.

References

Use After Free vulnerability report

low severity

CVE-2023-7008

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@245.4-4ubuntu3.18 and systemd/libudev1@245.4-4ubuntu3.18

Detailed paths

Introduced through: mongo@6.0.2-focal › systemd/libsystemd0@245.4-4ubuntu3.18
Introduced through: mongo@6.0.2-focal › systemd/libudev1@245.4-4ubuntu3.18

NVD Description

A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.

Remediation

There is no fixed version for Ubuntu:20.04 systemd.

References

CVE-2023-7008 vulnerability report

low severity

Improper Authentication

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.18

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.18 or higher.

References

Improper Authentication vulnerability report

low severity

CVE-2024-0727

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.21

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack

Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.

A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.

OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().

We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.

The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.21 or higher.

References

CVE-2024-0727 vulnerability report

low severity

Improper Authentication

Vulnerable module: shadow/login
Introduced through: shadow/login@1:4.8.1-1ubuntu5.20.04.2 and shadow/passwd@1:4.8.1-1ubuntu5.20.04.2
Fixed in: 1:4.8.1-1ubuntu5.20.04.5

Detailed paths

Introduced through: mongo@6.0.2-focal › shadow/login@1:4.8.1-1ubuntu5.20.04.2
Introduced through: mongo@6.0.2-focal › shadow/passwd@1:4.8.1-1ubuntu5.20.04.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

Remediation

Upgrade Ubuntu:20.04 shadow to version 1:4.8.1-1ubuntu5.20.04.5 or higher.

References

Improper Authentication vulnerability report

low severity

Excessive Iteration

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.20

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Checking excessively long DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.

The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p.

An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.

The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.20 or higher.

References

Excessive Iteration vulnerability report

low severity

Improper Certificate Validation

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.18

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification.

As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function.

Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument.

Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.18 or higher.

References

Improper Certificate Validation vulnerability report

low severity

Improper Certificate Validation

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.18

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.

Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.

Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.18 or higher.

References

Improper Certificate Validation vulnerability report

low severity

Improper Check for Unusual or Exceptional Conditions

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.21

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.

While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters.

Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q.

An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.

DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().

Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.21 or higher.

References

Improper Check for Unusual or Exceptional Conditions vulnerability report

low severity

Inefficient Regular Expression Complexity

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.20

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Checking excessively long DH keys or parameters may be very slow.

The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length.

However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large.

An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack.

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option.

The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.20 or higher.

References

Inefficient Regular Expression Complexity vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: xz-utils/liblzma5
Introduced through: xz-utils/liblzma5@5.2.4-1ubuntu1.1
Fixed in: 5.2.4-1ubuntu1.1+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › xz-utils/liblzma5@5.2.4-1ubuntu1.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream xz-utils package and not the xz-utils package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Remediation

Upgrade Ubuntu:20.04 xz-utils to version 5.2.4-1ubuntu1.1+esm1 or higher.

References

Heap-based Buffer Overflow vulnerability report

low severity

CVE-2023-4039

Vulnerable module: gcc-10/gcc-10-base
Introduced through: gcc-10/gcc-10-base@10.3.0-1ubuntu1~20.04, gcc-10/libgcc-s1@10.3.0-1ubuntu1~20.04 and others
Fixed in: 10.5.0-1ubuntu1~20.04.1+esm1

Detailed paths

Introduced through: mongo@6.0.2-focal › gcc-10/gcc-10-base@10.3.0-1ubuntu1~20.04
Introduced through: mongo@6.0.2-focal › gcc-10/libgcc-s1@10.3.0-1ubuntu1~20.04
Introduced through: mongo@6.0.2-focal › gcc-10/libstdc++6@10.3.0-1ubuntu1~20.04

NVD Description

Note: Versions mentioned in the description apply only to the upstream gcc-10 package and not the gcc-10 package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables.

The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

Remediation

Upgrade Ubuntu:20.04 gcc-10 to version 10.5.0-1ubuntu1~20.04.1+esm1 or higher.

References

CVE-2023-4039 vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm2 or higher.

References

NULL Pointer Dereference vulnerability report

low severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: shadow/login
Introduced through: shadow/login@1:4.8.1-1ubuntu5.20.04.2 and shadow/passwd@1:4.8.1-1ubuntu5.20.04.2

Detailed paths

Introduced through: mongo@6.0.2-focal › shadow/login@1:4.8.1-1ubuntu5.20.04.2
Introduced through: mongo@6.0.2-focal › shadow/passwd@1:4.8.1-1ubuntu5.20.04.2

NVD Description

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

Remediation

There is no fixed version for Ubuntu:20.04 shadow.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: gnutls28/libgnutls30
Introduced through: gnutls28/libgnutls30@3.6.13-2ubuntu1.7
Fixed in: 3.6.13-2ubuntu1.12+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › gnutls28/libgnutls30@3.6.13-2ubuntu1.7

NVD Description

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.

Remediation

Upgrade Ubuntu:20.04 gnutls28 to version 3.6.13-2ubuntu1.12+esm2 or higher.

References

Stack-based Buffer Overflow vulnerability report

low severity

CVE-2023-28322

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.19

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.19 or higher.

References

CVE-2023-28322 vulnerability report

low severity

CVE-2023-38546

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.20

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers.

libcurl provides a function call that duplicates en easy handle called curl_easy_duphandle.

If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.20 or higher.

References

CVE-2023-38546 vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: procps
Introduced through: procps@2:3.3.16-1ubuntu2.3 and procps/libprocps8@2:3.3.16-1ubuntu2.3
Fixed in: 2:3.3.16-1ubuntu2.4

Detailed paths

Introduced through: mongo@6.0.2-focal › procps@2:3.3.16-1ubuntu2.3
Introduced through: mongo@6.0.2-focal › procps/libprocps8@2:3.3.16-1ubuntu2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream procps package and not the procps package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.

Remediation

Upgrade Ubuntu:20.04 procps to version 2:3.3.16-1ubuntu2.4 or higher.

References

Out-of-bounds Write vulnerability report

low severity

Arbitrary Code Injection

Vulnerable module: shadow/login
Introduced through: shadow/login@1:4.8.1-1ubuntu5.20.04.2 and shadow/passwd@1:4.8.1-1ubuntu5.20.04.2

Detailed paths

Introduced through: mongo@6.0.2-focal › shadow/login@1:4.8.1-1ubuntu5.20.04.2
Introduced through: mongo@6.0.2-focal › shadow/passwd@1:4.8.1-1ubuntu5.20.04.2

NVD Description

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

Remediation

There is no fixed version for Ubuntu:20.04 shadow.

References

Arbitrary Code Injection vulnerability report

low severity

Incorrect Resource Transfer Between Spheres

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@245.4-4ubuntu3.18 and systemd/libudev1@245.4-4ubuntu3.18

Detailed paths

Introduced through: mongo@6.0.2-focal › systemd/libsystemd0@245.4-4ubuntu3.18
Introduced through: mongo@6.0.2-focal › systemd/libudev1@245.4-4ubuntu3.18

NVD Description

In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.

Remediation

There is no fixed version for Ubuntu:20.04 systemd.

References

Incorrect Resource Transfer Between Spheres vulnerability report

low severity

Memory Leak

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm3 or higher.

References

Memory Leak vulnerability report

low severity

CVE-2024-11053

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25 or higher.

References

CVE-2024-11053 vulnerability report

low severity

CVE-2025-15079

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm2 or higher.

References

CVE-2025-15079 vulnerability report

low severity

CVE-2025-15224

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm2 or higher.

References

CVE-2025-15224 vulnerability report

low severity

CVE-2026-3784

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm3 or higher.

References

CVE-2026-3784 vulnerability report

low severity

CVE-2026-8286

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm4

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm4 or higher.

References

CVE-2026-8286 vulnerability report

low severity

CVE-2026-8458

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm4

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm4 or higher.

References

CVE-2026-8458 vulnerability report

low severity

CVE-2026-8924

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13
Fixed in: 7.68.0-1ubuntu2.25+esm4

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Remediation

Upgrade Ubuntu:20.04 curl to version 7.68.0-1ubuntu2.25+esm4 or higher.

References

CVE-2026-8924 vulnerability report

low severity

CVE-2026-8932

Vulnerable module: curl/libcurl4
Introduced through: curl/libcurl4@7.68.0-1ubuntu2.13

Detailed paths

Introduced through: mongo@6.0.2-focal › curl/libcurl4@7.68.0-1ubuntu2.13

NVD Description

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Remediation

There is no fixed version for Ubuntu:20.04 curl.

References

CVE-2026-8932 vulnerability report

low severity

CVE-2024-26461

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.9

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.9 or higher.

References

CVE-2024-26461 vulnerability report

low severity

Memory Leak

Vulnerable module: krb5/krb5-locales
Introduced through: krb5/krb5-locales@1.17-6ubuntu4.1, krb5/libgssapi-krb5-2@1.17-6ubuntu4.1 and others
Fixed in: 1.17-6ubuntu4.9

Detailed paths

Introduced through: mongo@6.0.2-focal › krb5/krb5-locales@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libgssapi-krb5-2@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libk5crypto3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5-3@1.17-6ubuntu4.1
Introduced through: mongo@6.0.2-focal › krb5/libkrb5support0@1.17-6ubuntu4.1

NVD Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

Remediation

Upgrade Ubuntu:20.04 krb5 to version 1.17-6ubuntu4.9 or higher.

References

Memory Leak vulnerability report

low severity

Covert Timing Channel

Vulnerable module: libgcrypt20
Introduced through: libgcrypt20@1.8.5-5ubuntu1.1

Detailed paths

Introduced through: mongo@6.0.2-focal › libgcrypt20@1.8.5-5ubuntu1.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

Remediation

There is no fixed version for Ubuntu:20.04 libgcrypt20.

References

Covert Timing Channel vulnerability report

low severity

External Control of File Name or Path

Vulnerable module: libssh/libssh-4
Introduced through: libssh/libssh-4@0.9.3-2ubuntu2.2
Fixed in: 0.9.3-2ubuntu2.5+esm3

Detailed paths

Introduced through: mongo@6.0.2-focal › libssh/libssh-4@0.9.3-2ubuntu2.2

NVD Description

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.

Remediation

Upgrade Ubuntu:20.04 libssh to version 0.9.3-2ubuntu2.5+esm3 or higher.

References

External Control of File Name or Path vulnerability report

low severity

CVE-2024-13176

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24 or higher.

References

CVE-2024-13176 vulnerability report

low severity

CVE-2024-2511

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.23

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions

Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service

This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation.

This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients.

The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.23 or higher.

References

CVE-2024-2511 vulnerability report

low severity

CVE-2024-4741

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.23

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications.

The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use.

The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use.

The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use.

While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.23 or higher.

References

CVE-2024-4741 vulnerability report

low severity

CVE-2024-5535

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.23

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.

Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application.

The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists).

This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a "no overlap" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem.

In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur.

This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.23 or higher.

References

CVE-2024-5535 vulnerability report

low severity

CVE-2024-9143

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes.

Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a vulnerable application is low.

In particular, the X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any problematic use-cases would have to be using an "exotic" curve encoding.

The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions.

Applications working with "exotic" explicit binary (GF(2^m)) curve parameters, that make it possible to represent invalid field polynomials with a zero constant term, via the above or similar APIs, may terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot easily be ruled out.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24 or higher.

References

CVE-2024-9143 vulnerability report

low severity

CVE-2025-68160

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write.

Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application.

The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed onto stdout/stderr on VMS systems. Third-party applications that explicitly use this filter with a BIO chain that can short-write and that write large, newline-free data influenced by an attacker would be affected. However, the circumstances where this could happen are unlikely to be under attacker control, and BIO_f_linebuffer is unlikely to be handling non-curated data controlled by an attacker. For that reason the issue was assessed as Low severity.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the BIO implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm2 or higher.

References

CVE-2025-68160 vulnerability report

low severity

CVE-2025-69418

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: When using the low-level OCB API directly with AES-NI or other hardware-accelerated code paths, inputs whose length is not a multiple of 16 bytes can leave the final partial block unencrypted and unauthenticated. Impact summary: The trailing 1-15 bytes of a message may be exposed in cleartext on encryption and are not covered by the authentication tag, allowing an attacker to read or tamper with those bytes without detection. The low-level OCB encrypt and decrypt routines in the hardware-accelerated stream path process full 16-byte blocks but do not advance the input/output pointers. The subsequent tail-handling code then operates on the original base pointers, effectively reprocessing the beginning of the buffer while leaving the actual trailing bytes unprocessed. The authentication checksum also excludes the true tail bytes. However, typical OpenSSL consumers using EVP are not affected because the higher-level EVP and provider OCB implementations split inputs so that full blocks and trailing partial blocks are processed in separate calls, avoiding the problematic code path. Additionally, TLS does not use OCB ciphersuites. The vulnerability only affects applications that call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with non-block-aligned lengths in a single call on hardware-accelerated builds. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as OCB mode is not a FIPS-approved algorithm. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm2 or higher.

References

CVE-2025-69418 vulnerability report

low severity

CVE-2025-69419

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer.

Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service.

The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer.

The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

OpenSSL 1.0.2 is not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm2 or higher.

References

CVE-2025-69419 vulnerability report

low severity

CVE-2025-69420

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file.

Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service.

The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash.

Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was assessed as Low severity.

The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the TimeStamp Response implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

OpenSSL 1.0.2 is not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm2 or higher.

References

CVE-2025-69420 vulnerability report

low severity

CVE-2026-22795

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file.

Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service.

A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read.

The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For these reasons, the issue was assessed as Low severity.

The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

OpenSSL 1.0.2 is not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm2 or higher.

References

CVE-2026-22795 vulnerability report

low severity

CVE-2026-22796

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm2

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data.

Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service.

The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash.

Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be using the CMS API instead. For these reasons the issue was assessed as Low severity.

The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm2 or higher.

References

CVE-2026-22796 vulnerability report

low severity

CVE-2026-34180

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm4

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms.

Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated.

An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer.

Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm4 or higher.

References

CVE-2026-34180 vulnerability report

low severity

CVE-2026-42766

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm4

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption.

Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service.

The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present.

An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service.

Applications that process password-encrypted CMS messages may be affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm4 or higher.

References

CVE-2026-42766 vulnerability report

low severity

CVE-2026-7383

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm4

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow.

Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour.

In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation.

X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm4 or higher.

References

CVE-2026-7383 vulnerability report

low severity

CVE-2026-9076

Vulnerable module: openssl
Introduced through: openssl@1.1.1f-1ubuntu2.16 and openssl/libssl1.1@1.1.1f-1ubuntu2.16
Fixed in: 1.1.1f-1ubuntu2.24+esm4

Detailed paths

Introduced through: mongo@6.0.2-focal › openssl@1.1.1f-1ubuntu2.16
Introduced through: mongo@6.0.2-focal › openssl/libssl1.1@1.1.1f-1ubuntu2.16

NVD Description

Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key().

Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker.

The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen.

Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds.

The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator.

The FIPS modules are not affected by this issue.

Remediation

Upgrade Ubuntu:20.04 openssl to version 1.1.1f-1ubuntu2.24+esm4 or higher.

References

CVE-2026-9076 vulnerability report

low severity

CVE-2024-56433

Vulnerable module: shadow/login
Introduced through: shadow/login@1:4.8.1-1ubuntu5.20.04.2 and shadow/passwd@1:4.8.1-1ubuntu5.20.04.2

Detailed paths

Introduced through: mongo@6.0.2-focal › shadow/login@1:4.8.1-1ubuntu5.20.04.2
Introduced through: mongo@6.0.2-focal › shadow/passwd@1:4.8.1-1ubuntu5.20.04.2

NVD Description

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Remediation

There is no fixed version for Ubuntu:20.04 shadow.

References

CVE-2024-56433 vulnerability report

Vulnerabilities

Dependencies

Source

Target OS

high severity

CVE-2023-44487

Detailed paths

NVD Description

Remediation

References

high severity

Access of Resource Using Incompatible Type ('Type Confusion')

Detailed paths

NVD Description

Remediation

References

high severity

Out-of-bounds Write

Detailed paths

NVD Description

Remediation

References

high severity

CVE-2026-45447

Detailed paths

NVD Description

Remediation

References

medium severity

Exposure of Resource to Wrong Sphere

Detailed paths

NVD Description

Remediation

References

medium severity

Improper Null Termination

Detailed paths

NVD Description

Remediation

References

medium severity

CVE-2022-44640

Detailed paths

NVD Description

Remediation

References

medium severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

medium severity

CVE-2026-8376

Detailed paths

NVD Description

Remediation

References

medium severity

CVE-2025-6965

Detailed paths

NVD Description

Remediation

References

medium severity

Integer Underflow

Detailed paths

NVD Description

Remediation

References

medium severity

CVE-2024-37371

Detailed paths

NVD Description

Remediation

References

medium severity

CVE-2026-42496

Detailed paths

NVD Description

medium severity

new