CVE-2021-20335: 
MongoDB Ops Manager vulnerability analysis and mitigation

A security vulnerability (CVE-2021-20335) was identified in MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers. When upgrading to MongoDB Ops Manager versions prior to and including 4.4.12, a bug occurs where Automation thinks SSL is being turned off, potentially disabling SSL temporarily for cluster members. This issue affects systems that have SSL enabled for their MongoDB processes and are running with clientCertificateMode=OPTIONAL or allowConnectionsWithoutCertificates=true (NVD).

The vulnerability is classified as CWE-319 (Cleartext Transmission of Sensitive Information). It received a CVSS v3.1 base score of 6.7 MEDIUM from MongoDB, Inc. and 4.6 MEDIUM from NVD, with the vector string CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The issue is temporary and self-corrects after MongoDB Ops Manager instances complete their upgrade to version 4.4 (NVD).

The vulnerability could lead to temporary exposure of sensitive information during the upgrade process as SSL protection is temporarily disabled. This could potentially allow attackers with network access to intercept communications between cluster members during the vulnerable period (NVD).

The vulnerability requires an attacker to have network access and occurs specifically during the upgrade process from Ops Manager 4.2.x to 4.4.x. The exploitation window is limited to the duration of the upgrade process, and only affects systems with specific SSL configurations (NVD).

Customers can mitigate this vulnerability by upgrading from Ops Manager 4.2.X to 4.2.24 and then directly to Ops Manager 4.4.13 or later versions, which are unaffected by this issue. This upgrade path avoids the vulnerable versions and ensures continuous SSL protection (Vendor Advisory).