CVE-2017-15535

Name of the Vulnerable Software and Affected Versions MongoDB versions 3.4.x through 3.4.9 MongoDB versions 3.5.x-development

Description The issue is related to a configuration setting, networkMessageCompressors, which is disabled by default. When enabled, it exposes a potential problem that could be exploited by a malicious attacker to deny service or modify memory.

Recommendations For MongoDB versions 3.4.x through 3.4.9, consider disabling the networkMessageCompressors setting to prevent potential exploitation. For MongoDB versions 3.5.x-development, avoid using the networkMessageCompressors setting until a fix is available. As a temporary workaround, consider disabling the networkMessageCompressors setting for all affected versions until a patch is available.