Chris Sandulow

2 results

Log4Shell Vulnerability (CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105) and MongoDB

When MongoDB became aware of the Log4Shell vulnerability ( CVE-2021-44228 , CVE-2021-45046 and CVE-2021-45105 ), we began an investigation to determine whether there had been any impact to our products, services or internal systems. As of December 20, 4pm ET, the following is the status of our investigation: table { border-spacing: 0px; } th, td { border-bottom: 1px solid black; margin: 0px; padding: 4px; } . Product Status MongoDB Atlas Search Update - Dec 18: Confirmed log4j removal from production Environment. Atlas Search is no longer affected. Dec. 17: Patched to log4j v.2.16.0 in response to CVE-2021-45046 Dec. 12: Patched to log4j v.2.15.0 in response to CVE-2021-44228 No evidence of exploitation or indicators of compromise prior to the patches were discovered. All other components of MongoDB Atlas (including Atlas Database, Data Lake, Charts) Not affected MongoDB Enterprise Advanced (including Enterprise Server, Ops Manager, Enterprise Kubernetes Operators) Not affected MongoDB Community Edition (including Community Server, Cloud Manager, Community Kubernetes Operators) Not affected MongoDB Drivers Not affected MongoDB Tools (including Compass, Database Shell, VS Code Plugin, Atlas CLI, Database Connectors) Not affected MongoDB Realm (including Realm Database, Sync, Functions, APIs) Not affected We continue to monitor our system and services for any updates. If you have any questions, please visit the MongoDB Community Forums . If you are a MongoDB Commercial Support subscriber and have questions related to your deployments, please open a support case.

December 13, 2021