MongoDB Server up to 5.0.30/6.0.19/7.0.15/8.0.3 on Linux Certificate Chain improper check for certificate revocation

Summaryinfo

A vulnerability has been found in MongoDB Server up to 5.0.30/6.0.19/7.0.15/8.0.3 on Linux and classified as critical. Affected by this issue is some unknown functionality of the component Certificate Chain Handler. Performing a manipulation results in improper check for certificate revocation. This vulnerability is known as CVE-2025-3085. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in MongoDB Server up to 5.0.30/6.0.19/7.0.15/8.0.3 on Linux. This affects an unknown part of the component Certificate Chain Handler. The manipulation with an unknown input leads to a improper check for certificate revocation vulnerability. CWE is classifying the issue as CWE-299. The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 versions prior to 7.0.16 and MongoDB Server v8.0 versions prior to 8.0.4. Required Configuration : MongoDB Server must be running on Linux Operating Systems and CRL revocation status checking must be enabled

It is possible to read the advisory at jira.mongodb.org. This vulnerability is uniquely identified as CVE-2025-3085 since 04/01/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1557.003 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 264379 (Linux Distros Unpatched Vulnerability : CVE-2025-3085), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.0.31, 6.0.20, 7.0.16 or 8.0.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (264379). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• Server

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9
• 5.0.10
• 5.0.11
• 5.0.12
• 5.0.13
• 5.0.14
• 5.0.15
• 5.0.16
• 5.0.17
• 5.0.18
• 5.0.19
• 5.0.20
• 5.0.21
• 5.0.22
• 5.0.23
• 5.0.24
• 5.0.25
• 5.0.26
• 5.0.27
• 5.0.28
• 5.0.29
• 5.0.30
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.0.8
• 6.0.9
• 6.0.10
• 6.0.11
• 6.0.12
• 6.0.13
• 6.0.14
• 6.0.15
• 6.0.16
• 6.0.17
• 6.0.18
• 6.0.19
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 7.0.13
• 7.0.14
• 7.0.15
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion