CVE-2024-8013CWE-319

CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines

Low · published October 28, 2024

CVSS v3.1
2.2
EPSS
0%
Percentile
1.7
In the wild
Unconfirmed
What it is

A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.

The record
Technical detail
CVSS v3.1
2.2 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00120 · 1.7th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2024-10-28T12:58Z
EPSS history
Timeline
  • 28 OCT 12:58Z
    CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines
    cvelistv5