-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mongodb/mongo-tools | go | >= 100.0.0, < 100.2.0 | 100.2.0 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from the conditional check in configureClient() that combines SSLAllowInvalidCert/SSLAllowInvalidHost with TLSInsecure. The commit diff shows this function was modified to add TLSInsecure to the condition, but more critically, the original logic (opts.SSLAllowInvalidCert || opts.SSLAllowInvalidHost) caused InsecureSkipVerify to disable all validation when either deprecated flag was used. This matches the CWE-295 description of improper certificate validation, as using --sslAllowInvalidHostnames (intended for hostname checks only) inadvertently disabled full certificate validation through this function's logic.