MongoBleed explained simply
bigdata.2minutestreaming.com
CVE-2025-14847 allows attackers to read any arbitrary data from the database's heap memory. It affects all MongoDB versions since 2017, here's a simple explanation:
  • bigkahuna1986@lemmy.mlEnglish
    81·
    2 months ago

    I want to thank this guy for dropping this in Christmas.

    Luckily my mongo ports are hidden from the Internet, as everyone else’s should be, so it will survive until Monday when I can upgrade.

    • qaz@lemmy.worldOPEnglish
      1·
      2 months ago

      Doesn’t that make it slower because it needs to zero out all the bytes first?

      • rothaine@lemmy.zipEnglish
        2·
        2 months ago

        My understanding is that it’s only slightly slower: the OS maintains a pool of zeroed pages anyway, so it’s not like your program has to iterate over all the addresses and write to them.

        But it’s been a long time since I’ve done any C/C++ so I could be wrong.

        • qaz@lemmy.worldOPEnglish
          2·
          2 months ago

          the OS maintains a pool of zeroed pages

          TIL, I didn’t know that.