-
Notifications
You must be signed in to change notification settings - Fork 76
Description
"MongoBleed" vulnerability affects the version of MongoDB we deploy for VC-Authn.
NIST detail: https://nvd.nist.gov/vuln/detail/CVE-2025-14847
Mongo issue: https://jira.mongodb.org/browse/SERVER-115508
While nothing too sensitive in that DB (and in our case would probably need to do something else to get a client-side connection, or have a broken network security policy?) it's a should-fix.
Current version seems to be v8.0.4. Could upgrade to latest 8.2.3 or if we don't want to do a minor version, just up to 8.0.17
Docker compose version probably not affected (or would matter) as it pulls an 8.0 reference so probably uses latest of that minor version? Should check on that, and if decision is to use 8.2.x for deployments, upgrade docker compose version of mongo as well.
Work to mitigate deployments in Helm Chart repo tracked here: openwallet-foundation/helm-charts#74