Threats tagged 'ghsa-hqj2-5572-frj2'

MongoDB's macOS TLS client implementation using Apple SecureTransport improperly bypasses certificate chain-of-trust validation for outbound IPv6 connections. This allows an on-path attacker to present a self-signed certificate with the target's IPv6 address in the Subject Alternative Name and intercept or modify encrypted traffic. The issue affects only MongoDB processes running on macOS with this TLS provider.