CVE-2020-7924: 
Linux Debian vulnerability analysis and mitigation

A validation flaw was discovered in MongoDB Tools where a specific command-line parameter, originally intended to skip hostname checks, could result in bypassing all certificate validation. The vulnerability, identified as CVE-2020-7924, affects multiple versions of MongoDB Database Tools and Mongomirror (MongoDB Jira).

The vulnerability has been assigned a CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). The issue is classified under CWE-295: Improper Certificate Validation. The affected versions include MongoDB Database Tools 3.6 (after 3.6.5 and before 3.6.21), 4.0 (before 4.0.21), 4.2 (before 4.2.11), 100 (before 100.2.0), and Mongomirror 0 (versions after 0.6.0) (MongoDB Jira).

The vulnerability could lead to accepting invalid certificates, potentially compromising the security of SSL/TLS connections. This could expose sensitive data and allow for potential man-in-the-middle attacks (MongoDB Jira).

The issue has been fixed in subsequent releases of MongoDB Tools. Users should upgrade to MongoDB Database Tools versions 3.6.21, 4.0.21, 4.2.11, or 100.2.0 or later, depending on their current version. The parameters sslAllowInvalidHostnames and sslAllowInvalidCertificates have been deprecated (MongoDB Jira).