CVE-2023-0437: MongoDB client C Driver may infinitely loop when validating certain BSON input data
When calling bsonutf8validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/mongo-c-driverto a version that resolves this vulnerability.Fixed in 1.25.4-r0 - Upgrade
Upgrade
MongoDB C Driverto a version that resolves this vulnerability.Fixed in 1.25.0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0437?
CVE-2023-0437 has a moderate severity due to the potential for causing an infinite loop.
How do I fix CVE-2023-0437?
To fix CVE-2023-0437, upgrade to MongoDB C Driver version 1.25.0 or later.
What versions of MongoDB C Driver are affected by CVE-2023-0437?
CVE-2023-0437 affects all versions of MongoDB C Driver prior to version 1.25.0.
What types of inputs trigger the issue in CVE-2023-0437?
CVE-2023-0437 is triggered by certain inputs passed to the bson_utf8_validate function.
Is CVE-2023-0437 exploitable remotely?
CVE-2023-0437 does not indicate remote exploitation potential as it relates to input validation in the C Driver.