Skip to content

Patch mongodb version for security updates #942

@loneil

Description

@loneil

"MongoBleed" vulnerability affects the version of MongoDB we deploy for VC-Authn.

NIST detail: https://nvd.nist.gov/vuln/detail/CVE-2025-14847

Mongo issue: https://jira.mongodb.org/browse/SERVER-115508

While nothing too sensitive in that DB (and in our case would probably need to do something else to get a client-side connection, or have a broken network security policy?) it's a should-fix.

Current version seems to be v8.0.4. Could upgrade to latest 8.2.3 or if we don't want to do a minor version, just up to 8.0.17

Docker compose version probably not affected (or would matter) as it pulls an 8.0 reference so probably uses latest of that minor version? Should check on that, and if decision is to use 8.2.x for deployments, upgrade docker compose version of mongo as well.

Work to mitigate deployments in Helm Chart repo tracked here: openwallet-foundation/helm-charts#74

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions