{"document":{"aggregate_severity":{"namespace":"https://www.suse.com/support/security/rating/","text":"moderate"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright 2024 SUSE LLC. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"SUSE CVE-2019-2389","title":"Title"},{"category":"description","text":"Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.","title":"Description of the CVE"},{"category":"legal_disclaimer","text":"CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).","title":"Terms of use"}],"publisher":{"category":"vendor","contact_details":"https://www.suse.com/support/security/contact/","name":"SUSE Product Security Team","namespace":"https://www.suse.com/"},"references":[{"category":"external","summary":"CVE-2019-2389","url":"https://www.suse.com/security/cve/CVE-2019-2389"},{"category":"external","summary":"SUSE Security Ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"external","summary":"SUSE Bug 1149102 for CVE-2019-2389","url":"https://bugzilla.suse.com/1149102"}],"title":"SUSE CVE CVE-2019-2389","tracking":{"current_release_date":"2025-04-25T06:37:14Z","generator":{"date":"2023-02-15T04:19:15Z","engine":{"name":"cve-database.git:bin/generate-csaf-vex.pl","version":"1"}},"id":"CVE-2019-2389","initial_release_date":"2023-02-15T04:19:15Z","revision_history":[{"date":"2023-02-15T04:19:15Z","number":"2","summary":"Current version"},{"date":"2025-01-01T07:05:03Z","number":"3","summary":"Current version"},{"date":"2025-02-15T07:46:57Z","number":"4","summary":"Current version"},{"date":"2025-02-18T06:45:14Z","number":"5","summary":"Current version"},{"date":"2025-03-15T11:40:25Z","number":"6","summary":"Current version"},{"date":"2025-04-25T06:37:14Z","number":"7","summary":"Current version"}],"status":"interim","version":"7"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"HPE Helion OpenStack Cloud 8","product":{"name":"HPE Helion OpenStack Cloud 8","product_id":"HPE Helion OpenStack Cloud 8"}},{"category":"product_name","name":"SUSE OpenStack Cloud 6-LTSS","product":{"name":"SUSE OpenStack Cloud 6-LTSS","product_id":"SUSE OpenStack Cloud 6-LTSS","product_identification_helper":{"cpe":"cpe:/o:suse:suse-openstack-cloud-ltss:6"}}},{"category":"product_name","name":"SUSE OpenStack Cloud 7","product":{"name":"SUSE OpenStack Cloud 7","product_id":"SUSE OpenStack Cloud 7","product_identification_helper":{"cpe":"cpe:/o:suse:suse-openstack-cloud:7"}}},{"category":"product_version","name":"mongodb","product":{"name":"mongodb","product_id":"mongodb","product_identification_helper":{"cpe":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","purl":"pkg:rpm/suse/mongodb@?upstream=mongodb.src.rpm"}}}],"category":"product_family","name":"SUSE Linux Enterprise"}],"category":"vendor","name":"SUSE"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"mongodb as component of HPE Helion OpenStack Cloud 8","product_id":"HPE Helion OpenStack Cloud 8:mongodb"},"product_reference":"mongodb","relates_to_product_reference":"HPE Helion OpenStack Cloud 8"},{"category":"default_component_of","full_product_name":{"name":"mongodb as component of SUSE OpenStack Cloud 6-LTSS","product_id":"SUSE OpenStack Cloud 6-LTSS:mongodb"},"product_reference":"mongodb","relates_to_product_reference":"SUSE OpenStack Cloud 6-LTSS"},{"category":"default_component_of","full_product_name":{"name":"mongodb as component of SUSE OpenStack Cloud 7","product_id":"SUSE OpenStack Cloud 7:mongodb"},"product_reference":"mongodb","relates_to_product_reference":"SUSE OpenStack Cloud 7"}]},"vulnerabilities":[{"cve":"CVE-2019-2389","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2019-2389"}],"notes":[{"category":"general","text":"Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.","title":"CVE description"}],"product_status":{"known_not_affected":["HPE Helion OpenStack Cloud 8:mongodb","SUSE OpenStack Cloud 6-LTSS:mongodb","SUSE OpenStack Cloud 7:mongodb"]},"references":[{"category":"external","summary":"CVE-2019-2389","url":"https://www.suse.com/security/cve/CVE-2019-2389"},{"category":"external","summary":"SUSE Security Ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"external","summary":"SUSE Bug 1149102 for CVE-2019-2389","url":"https://bugzilla.suse.com/1149102"}],"threats":[{"category":"impact","date":"2019-08-30T21:43:24Z","details":"moderate"}],"title":"CVE-2019-2389"}]}