Advisoriesby IbisMongoDBGHSA-h2g7-2gxh-c5v2
Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds
Fix: upgrade to 1.30.9 or later (2 fixed versions below)
Impact
An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.
Patches
Fixed in 1.30.9 and 2.5.1.
Workarounds
Check length of input JSON prior to parsing.
References
https://jira.mongodb.org/browse/CDRIVER-6405
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB C Driver Product | >= 1.10.0, < 1.30.9 | 1.30.9 |
| >= 2.0.0, < 2.5.2 | 2.5.2 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)