MongoBleed explained simply
bigdata.2minutestreaming.com
CVE-2025-14847 allows attackers to read any arbitrary data from the database's heap memory. It affects all MongoDB versions since 2017, here's a simple explanation:
  • bigkahuna1986@lemmy.mlEnglish
    3 months

    I want to thank this guy for dropping this in Christmas.

    Luckily my mongo ports are hidden from the Internet, as everyone else’s should be, so it will survive until Monday when I can upgrade.

    • Em Adespoton@lemmy.caEnglish
      3 months

      It is fixed as of writing, but some EOL versions (3.6, 4.0, 4.2) will not get it.

      You probably are already up to date.

      I know my MongoDB updated around the 17th.

  • ranzispa@mander.xyzEnglish
    3 months

    Hey Mongo, store this stuff; trust me it’s 1 MB. In case it turns out it is not, just give me 1 MB worth of your data.

    Thank you very much.

    • qaz@lemmy.worldEnglish
      3 months

      Doesn’t that make it slower because it needs to zero out all the bytes first?

      • rothaine@lemmy.zipEnglish
        3 months

        My understanding is that it’s only slightly slower: the OS maintains a pool of zeroed pages anyway, so it’s not like your program has to iterate over all the addresses and write to them.

        But it’s been a long time since I’ve done any C/C++ so I could be wrong.

        • qaz@lemmy.worldEnglish
          3 months

          the OS maintains a pool of zeroed pages

          TIL, I didn’t know that.