CVE-2020-7610: Critical severity MongoDB Bson Node.js vulnerability
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Other sources
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/bsonto a version that resolves this vulnerability.Fixed in 1.1.4 - Upgrade
Upgrade
bsonto a version that resolves this vulnerability.Fixed in 1.1.4
Event History
Frequently Asked Questions
What is CVE-2020-7610?
CVE-2020-7610 is a vulnerability that allows for the Deserialization of Untrusted Data in the bson package before version 1.1.4.
How does CVE-2020-7610 affect the bson package?
CVE-2020-7610 affects all versions of the bson package before version 1.1.4.
What is the severity of CVE-2020-7610?
The severity of CVE-2020-7610 is critical with a CVSS score of 9.8.
How can I fix CVE-2020-7610?
To fix CVE-2020-7610, update the bson package to version 1.1.4 or later.
What is the Common Weakness Enumeration (CWE) for CVE-2020-7610?
The Common Weakness Enumeration (CWE) for CVE-2020-7610 is CWE-502.