CVE-2025-14847

CVE-2025-14847 漏洞环境附带一份poc

https://jira.mongodb.org/browse/SERVER-115508

SUMMARY

This is a critical fix to address CVE-2025-14847. Upgrade to 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30.

ISSUE DESCRIPTION AND IMPACT

An client-side exploit of the Server's zlib implementation can return uninitialized heap memory without authenticating to the server. We strongly recommend upgrading to a fixed version as soon as possible.

This issue affects MongoDB versions:

• MongoDB 8.2.0 through 8.2.3
• MongoDB 8.0.0 through 8.0.16
• MongoDB 7.0.0 through 7.0.26
• MongoDB 6.0.0 through 6.0.26
• MongoDB 5.0.0 through 5.0.31
• MongoDB 4.4.0 through 4.4.29
• All MongoDB Server v4.2 versions
• All MongoDB Server v4.0 versions
• All MongoDB Server v3.6 versions

WORKAROUND

We strongly suggest you upgrade immediately.

If you cannot upgrade immediately, disable zlib compression on the MongoDB Server by starting mongod or mongos with a networkMessageCompressors or a net.compression.compressors option that explicitly omits zlib. Example safe values include snappy,zstd or disabled

REMEDIATION

Upgrade to MongoDB 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30.

参考连接：

• https://jira.mongodb.org/browse/SERVER-115508

• https://github.com/mongodb/mongo/commit/1264f9be5165abb0981f8023d2495652ab916699#diff-fd797e63d8e20a16cf0adcb6b5542f2124de9bf6f3afa913ba8d09d3022b11ac

• https://github.com/mongodb/mongo/blob/1264f9be5165abb0981f8023d2495652ab916699/src/mongo/transport/message_compressor_manager_test.cpp

注意： 该仓库内容包含AI生成。