First published: Wed Jun 05 2024(Updated: )
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
Credit: cna@mongodb.com cna@mongodb.com
Affected Software | Affected Version | How to fix |
---|---|---|
Mongodb Pymongo | <4.6.3 | |
Debian Debian Linux | =10.0 | |
pip/pymongo | <4.6.3 | 4.6.3 |
debian/pymongo | <=3.11.0-1 | 3.11.0-1+deb12u1 4.7.3-1 |
ubuntu/pymongo | <3.6.1+dfsg1-1ubuntu0.1~ | 3.6.1+dfsg1-1ubuntu0.1~ |
ubuntu/pymongo | <3.10.1-0ubuntu2.1 | 3.10.1-0ubuntu2.1 |
ubuntu/pymongo | <3.11.0-1ubuntu0.22.04.1 | 3.11.0-1ubuntu0.22.04.1 |
ubuntu/pymongo | <3.11.0-1ubuntu0.24.04.1 | 3.11.0-1ubuntu0.24.04.1 |
ubuntu/pymongo | <3.2-1ubuntu0.1~ | 3.2-1ubuntu0.1~ |
https://github.com/mongodb/mongo-python-driver/commit/56b6b6dbc267d365d97c037082369dabf37405d2
https://github.com/mongodb/mongo-python-driver/commit/372b5d68d5a57ccc43b33407cd23f0bc79d99283
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.