4 ms·

This seems like Seriously Bad News for folks like MongoHQ. I'm hoping they're running 2.4.1, though?

• mrkurt 14y ago
  It's less of a problem than you'd expect, most of our DBs run in isolated processes and an authenticated user (even with shell) can't really break out and run wild on the environment. We expected that the Mongo javascript engine would have vulnerabilities like this and started trying to get ahead of them about 18 months ago. About 3% of our servers are either legacy, and the isolation hasn't been tested all that well, or sandbox environments where people share a process for tiny/test DBs. We've upgraded all of those to 2.4.1.
  • cheald 14y ago
    That's great to hear. Big respect to you guys for solving that problem before it was a problem!