好的，我现在需要帮用户总结一篇文章的内容，控制在100字以内。首先，我得仔细阅读文章内容，理解其主要信息。 文章开头提到MongoDB警告IT管理员立即修补一个高危漏洞，这个漏洞可能导致远程代码执行攻击。接着详细说明了漏洞的编号CVE-2025-14847，影响多个版本的MongoDB和MongoDB Server。攻击者无需认证即可利用此漏洞，攻击复杂度低。 然后，文章解释了漏洞的原因是处理长度参数不一致的问题，允许攻击者执行任意代码并控制设备。建议管理员升级到特定版本来修复漏洞，并列出了受影响的版本范围。 此外，MongoDB的安全团队建议如果无法立即升级，可以禁用zlib压缩。还提到了CISA之前处理过另一个MongoDB的RCE漏洞，并要求联邦机构加强防护。 最后，文章介绍了MongoDB作为一个流行的非关系型数据库管理系统，被全球超过62,500个客户使用。 现在我需要将这些信息浓缩到100字以内。重点包括：高危漏洞CVE-2025-14847允许未认证攻击者远程执行代码；影响多个版本；原因和修复建议；以及MongoDB的重要性。 可能的结构： MongoDB警告高危漏洞CVE-2025-14847，允许未认证攻击者远程执行代码；影响多个版本；因长度参数处理不当；建议升级或禁用zlib压缩；影响广泛。 </think> MongoDB警告高危漏洞CVE-2025-14847允许未认证攻击者远程执行代码，影响多个版本。因长度参数处理不当导致，建议升级或禁用zlib压缩以修复。该漏洞影响广泛，涉及众多企业客户。 2025-12-24 15:31:22 Author: www.bleepingcomputer.com(查看原文) 阅读量:0 收藏
MongoDB has warned IT admins to immediately patch a high-severity vulnerability that can be exploited in remote code execution (RCE) attacks targeting vulnerable servers.
Tracked as CVE-2025-14847, this security flaw affects multiple MongoDB and MongoDB Server versions and can be exploited by unauthenticated threat actors in low-complexity attacks that don't require user interaction.
CVE-2025-14847 is due to an improper handling of length parameter inconsistency, which can allow attackers to execute arbitrary code and potentially gain control of targeted devices.
To patch the security flaw and block potential attacks, admins are advised to immediately upgrade to MongoDB 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30.
The vulnerability impacts the following MongoDB versions:
- MongoDB 8.2.0 through 8.2.3
- MongoDB 8.0.0 through 8.0.16
- MongoDB 7.0.0 through 7.0.26
- MongoDB 6.0.0 through 6.0.26
- MongoDB 5.0.0 through 5.0.31
- MongoDB 4.4.0 through 4.4.29
- All MongoDB Server v4.2 versions
- All MongoDB Server v4.0 versions
- All MongoDB Server v3.6 versions
"An client-side exploit of the Server's zlib implementation can return uninitialized heap memory without authenticating to the server. We strongly recommend upgrading to a fixed version as soon as possible," MongoDB's security team said in a Friday advisory.
"We strongly suggest you upgrade immediately. If you cannot upgrade immediately, disable zlib compression on the MongoDB Server by starting mongod or mongos with a networkMessageCompressors or a net.compression.compressors option that explicitly omits zlib."
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added another MongoDB RCE flaw (CVE-2019-10758) to its catalog of known exploited vulnerabilities four years ago, tagging it as actively exploited and ordering federal agencies to secure their systems, as mandated by Binding Operational Directive (BOD) 22-01.
MongoDB is a popular non-relational database management system (DBMS) that, unlike relational databases such as PostgreSQL and MySQL, stores data in BSON (Binary JSON) documents instead of tables.
The database software is used by more than 62,500 customers worldwide, including dozens of Fortune 500 companies.
Break down IAM silos like Bitpanda, KnowBe4, and PathAI
Broken IAM isn't just an IT problem - the impact ripples across your whole business.
This practical guide covers why traditional IAM practices fail to keep up with modern demands, examples of what "good" IAM looks like, and a simple checklist for building a scalable strategy.
如有侵权请联系:admin#unsafe.sh