Every applicability statement published about this vulnerability, kept as each source wrote it rather than merged into one verdict. Where sources disagree, both positions are shown.
A statement that names no version covers the whole product, which is not the same as your version falling inside a range. Orderings marked best effort come from schemes with no published comparison algorithm; exact ones follow a published specification.
Precedence decides which claim wins when two sources describe the same product over the same version range. It is a property of the source, not of the claim, and changing it re-ranks the data without re-reading a single document.
| Product | Status | Versions | Remediation | Source | |
|---|---|---|---|---|---|
| red_hat_update_infrastructure_3_for_cloud_providers:mongodb.src mongodb.src as a component of Red Hat Update Infrastructure 3 for Cloud Providers | affected | no version stated vendor label: mongodb.src | no fix planned | csaf_redhat | |
| red_hat_openshift_data_foundation_4:noobaa-core-container noobaa-core-container as a component of Red Hat Openshift Data Foundation 4 | affected | no version stated vendor label: noobaa-core-container | out of support | csaf_redhat | |
| red_hat_openshift_data_foundation_4:odf4/mcg-core-rhel9 odf4/mcg-core-rhel9 as a component of Red Hat Openshift Data Foundation 4 | affected | odf4/mcg-core-rhel9 | out of support | csaf_redhat | |
| red_hat_satellite_6:libmongodb libmongodb as a component of Red Hat Satellite 6 | not affected vulnerable code not present | no version stated vendor label: libmongodb | not applicable | csaf_redhat | |
| red_hat_satellite_6:mongodb mongodb as a component of Red Hat Satellite 6 | not affected vulnerable code not present | no version stated vendor label: mongodb | not applicable | csaf_redhat | |
| red_hat_satellite_6:mongodb-server mongodb-server as a component of Red Hat Satellite 6 | not affected vulnerable code not present | no version stated vendor label: mongodb-server | not applicable | csaf_redhat | |
| red_hat_satellite_6:mongodb.src mongodb.src as a component of Red Hat Satellite 6 | not affected vulnerable code not present | no version stated vendor label: mongodb.src | not applicable | csaf_redhat | |
| https://github.com/mongodb/mongo | affected | >= a4b751dcf51dd249c5865812b390cfd1c0129c30, < 8a5c1f52a77bc92320c90ecbe5424e841874296e | vendor fix → 8a5c1f52a77bc92320c90ecbe5424e841874296e | osv | |
| https://github.com/mongodb/mongo | affected | >= 563487e100c4215e2dce98d0af2a6a5a2d67c5cf, < b7530cacde8432d2f22ed506f258ff9c3b45c5e9 | vendor fix → b7530cacde8432d2f22ed506f258ff9c3b45c5e9 | osv | |
| https://github.com/mongodb/mongo | affected | >= 1184f004a99660de6f5e745573419bda8a28c0e9, < 62a84ede3cc9a334e8bc82160714df71e7d3a29e | vendor fix → 62a84ede3cc9a334e8bc82160714df71e7d3a29e | osv | |
| mongodb | affected | >= 4.2.0, < 4.2.16 | vendor fix → 4.2.16 | osv BIT-mongodb-2021-32040 | |
| mongodb | affected | >= 4.4.0, < 4.4.11 | vendor fix → 4.4.11 | osv BIT-mongodb-2021-32040 | |
| mongodb | affected | >= 5.0.0, < 5.0.4 | vendor fix → 5.0.4 | osv BIT-mongodb-2021-32040 | |
| https://github.com/mongodb/mongo | fixed | 8a5c1f52a77bc92320c90ecbe5424e841874296e | vendor fix → 8a5c1f52a77bc92320c90ecbe5424e841874296e | osv | |
| https://github.com/mongodb/mongo | fixed | b7530cacde8432d2f22ed506f258ff9c3b45c5e9 | vendor fix → b7530cacde8432d2f22ed506f258ff9c3b45c5e9 | osv | |
| https://github.com/mongodb/mongo | fixed | 62a84ede3cc9a334e8bc82160714df71e7d3a29e | vendor fix → 62a84ede3cc9a334e8bc82160714df71e7d3a29e | osv | |
| mongodb | fixed | 4.2.16 | vendor fix → 4.2.16 | osv BIT-mongodb-2021-32040 | |
| mongodb | fixed | 4.4.11 | vendor fix → 4.4.11 | osv BIT-mongodb-2021-32040 | |
| mongodb | fixed | 5.0.4 | vendor fix → 5.0.4 | osv BIT-mongodb-2021-32040 | |
| MongoDB Inc./MongoDB Server MongoDB Inc. · MongoDB Server | affected | >= 5.0, < 5.0.4 | none available | cve_cna | |
| MongoDB Inc./MongoDB Server MongoDB Inc. · MongoDB Server | affected | >= 4.4, <= 4.4.28 | none available | cve_cna | |
| MongoDB Inc./MongoDB Server MongoDB Inc. · MongoDB Server | affected | >= 4.2, < 4.2.16 | none available | cve_cna | |
| mongodb/mongodb mongodb · mongodb | affected | >= 5.0, < 5.0.4 | none available | cve_adp | |
| mongodb/mongodb mongodb · mongodb | affected | >= 4.4, <= 4.4.28 | none available | cve_adp | |
| mongodb/mongodb mongodb · mongodb | affected | >= 4.2, < 4.2.16 | none available | cve_adp |
A claim with no version range is shown as written rather than expanded: a government catalog naming only a vendor and product is a real statement at zero granularity, and inventing bounds for it would put precision in the record that the source never offered.