CVE-2019-2386

Vendor solution

After deleting one or more users, restart any nodes which may have had active user authorization sessions.

Refrain from creating user accounts with the same name as previously deleted accounts.

Red Hat statement

The supported versions of Red Hat Satellite do not ship the affected MongoDB and are only consumed through Red Hat Software Collections (RHSCL) repository. However, the product is not affected by the vulnerability because the usage of MongoDB does not add or delete users on a recurring basis. This issue does affect the versions of MongoDB as shipped with Red Hat Update Infrastructure for Cloud Providers, but the service is only accessible by users who already have access to the Red Hat Update Appliance (RHUA).

Red Hat mitigation

This vulnerability can be mitigated by either of two administrative practices: * Whenever a user is deleted, restart all nodes where that user may have an active session * When a user is deleted, ensure than a new user with the same name will never be created If your mongodb instance is deployed in a situation where users never need to be deleted, or one of the above mitigations can be applied, this vulnerability can not be exploited.