By the Year
In 2023 there have been 0 vulnerabilities in MongoDB Libmongocrypt . Libmongocrypt did not have any published security vulnerabilities last year.
It may take a day or so for new Libmongocrypt vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent MongoDB Libmongocrypt Security Vulnerabilities
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS servers certificate
6.8 - Medium
- February 25, 2021
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS servers certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that dont use Field Level Encryption.
Improper Certificate Validation