Re: CVE request: mongodb: world-readable .dbshell history file

[Sébastien Delafond <seb () debian org>]

On 2016-08-01, Grant Ridder <shortdudey123 () gmail com> wrote:
> FWIW, the vendor has closed
> https://jira.mongodb.org/browse/SERVER-25335 with "Works as
> Designed"

Whatever the umask value is, an application should apply proper
permissions on files deemed sensitive. For instance, ssh-keygen(1)
will never create a world-readable private key, regardless of what the
umask is.

Cheers,

--Seb