STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate recognized and approved by the organization.

DISA Rule

SV-279398r1179494_rule

Vulnerability Number

V-279398

Group Title

SRG-APP-000810-DB-000150

Rule Version

MD8X-00-012700

Severity

CAT II

CCI(s)

CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

Fix Recommendation

Ensure the MongoDB repository is configured according to the official documentation.

Install any missing or outdated components by running the command:

$ sudo yum update --repo mongodb-enterprise-8.0

Restart the MongoDB service:

$ sudo systemctl restart mongod

The YUM method is the preferred method because it provides automatic dependency management, built-in rollback support, and simplified security updates. These features reduce the risk of misconfiguration and ensure a more stable and secure environment that is easier to maintain and keep compliant.

For additional details, refer to the MongoDB documentation:
https://www.mongodb.com/docs/v8.0/tutorial/install-mongodb-enterprise-on-red-hat/

Check Contents

1. Identify that the MongoDB repository is installed and enabled by running the following command:

$ yum repolist enabled | grep "mongodb-enterprise-8.0".

2. Review the contents of the repository file (/etc/yum.repos.d/mongodb-enterprise-8.0.repo) and compare them to the standard configuration below:

[mongodb-enterprise-8.0]
name=MongoDB Enterprise Repository
baseurl=https://repo.mongodb.com/yum/redhat/9/mongodb-enterprise/8.0/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://pgp.mongodb.com/server-8.0.asc

3. Examine the installed MongoDB components and their versions by running the following command:

$ yum list installed mongodb-*

4. The output will resemble the following, but with potentially different versions:

Installed Packages

mongodb-database-tools.x86_64 100.12.2-1 @mongodb-enterprise-8.0
mongodb-enterprise.x86_64 8.0.12-1.el9 @mongodb-enterprise-8.0
mongodb-enterprise-cryptd.x86_64 8.0.12-1.el9 @mongodb-enterprise-8.0
mongodb-enterprise-database.x86_64 8.0.12-1.el9 @mongodb-enterprise-8.0
mongodb-enterprise-database-tools-extra.x86_64 8.0.12-1.el9 @mongodb-enterprise-8.0
mongodb-enterprise-mongos.x86_64 8.0.12-1.el9 @mongodb-enterprise-8.0
mongodb-enterprise-server.x86_64 8.0.12-1.el9 @mongodb-enterprise-8.0
mongodb-enterprise-tools.x86_64 8.0.12-1.el9 @mongodb-enterprise-8.0
mongodb-mongosh.x86_64 2.5.6-1.el8 @mongodb-enterprise-8.0

5. Check for available updates for the installed MongoDB components by running the following command:
$ sudo yum check-update --repo mongodb-enterprise-8.0

The output will list any components that need to be updated.

If the MongoDB repository is not enabled, its contents do not match the standard configuration, or if any components are not installed or are not the most current version available, this is a finding.

Vulnerability Number

V-279398

Documentable

False

Rule Version

MD8X-00-012700

Severity Override Guidance

Check Content Reference

Target Key

5728