GHSA-8fvv-fgr5-f8ch: Pip/pymongo vulnerability
Impact
When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match.
Patches Patch available in pymongo >= 4.18.1
Workarounds Ensure your existing workflow only supports exact matching on the GridFS API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pymongoto a version that resolves this vulnerability.Fixed in 4.18.1 - Upgrade
Upgrade
pymongoto a version that resolves this vulnerability.Fixed in 4.18.1 - Configuration
Require exact matching on the given ID when reading or writing via an ID with the GridFS API.
GridFS API ID matching = exact match
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the PyMongo GridFS API to read or write files by ID may be exposed if their workflow accepts a Hash where an exact ID value is expected. The affected behavior is addressed in pymongo 4.18.1 and later.
What does an attacker need to exploit it?
An attacker would need to supply a Hash in place of a GridFS file ID in a code path that passes that value to the GridFS API. The Hash may be interpreted as query criteria and override the intended ID match.
What can be done if upgrading is not immediately possible?
Ensure the application workflow only permits exact matching on GridFS API IDs. Do not allow Hash values or other query-like structures to be used where an ID is expected.