UBUNTU-CVE-2021-20335

    Dashboard / Vulnerabilities / UBUNTU-CVE-2021-20335

    UBUNTU-CVE-2021-20335

    Published: 11 Feb 2021Last Modified: 19 Feb 2026
    Upstream:
    CVE-2021-20335

    Summary:

    Details: For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue.

    References: https://ubuntu.com/security/CVE-2021-20335, https://docs-opsmanager-staging.mongodb.com/docsworker-xlarge/DOCSP-14164/release-notes/application.html, https://www.cve.org/CVERecord?id=CVE-2021-20335

    Affected packages

    Package

    Name: mongodb

    Purl: pkg:deb/ubuntu/mongodb@1:2.4.9-1ubuntu2?arch=source&distro=trusty

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1:2.4.6-0ubuntu5
    1:2.4.6-0ubuntu6
    1:2.4.8-1ubuntu1
    1:2.4.8-2
    1:2.4.9-1
    1:2.4.9-1ubuntu1
    1:2.4.9-1ubuntu2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2021-20335 | CVE-DB