Log4Shell Vulnerability (CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105) and MongoDB
When MongoDB became aware of the Log4Shell vulnerability (
CVE-2021-44228
,
CVE-2021-45046
and
CVE-2021-45105
), we began an investigation to determine whether there had been any impact to our products, services or internal systems.
As of December 20, 4pm ET, the following is the status of our investigation:
table {
border-spacing: 0px;
}
th, td {
border-bottom: 1px solid black;
margin: 0px;
padding: 4px;
}
.
Product
Status
MongoDB Atlas Search
Update - Dec 18: Confirmed log4j removal from production Environment. Atlas Search is no longer affected.
Dec. 17: Patched to log4j v.2.16.0 in response to
CVE-2021-45046
Dec. 12: Patched to log4j v.2.15.0 in response to
CVE-2021-44228
No evidence of exploitation or indicators of compromise prior to the patches were discovered.
All other components of MongoDB Atlas (including Atlas Database, Data Lake, Charts)
Not affected
MongoDB Enterprise Advanced (including Enterprise Server, Ops Manager, Enterprise Kubernetes Operators)
Not affected
MongoDB Community Edition (including Community Server, Cloud Manager, Community Kubernetes Operators)
Not affected
MongoDB Drivers
Not affected
MongoDB Tools (including Compass, Database Shell, VS Code Plugin, Atlas CLI, Database Connectors)
Not affected
MongoDB Realm (including Realm Database, Sync, Functions, APIs)
Not affected
We continue to monitor our system and services for any updates. If you have any questions, please visit the
MongoDB Community Forums
. If you are a
MongoDB Commercial Support
subscriber and have questions related to your deployments, please open a support case.
December 13, 2021