Advisoriesby IbisMongoDBGHSA-j5wj-7mj9-v673
Heap out-of-bounds read via corrupt nested BSON in field path error message
Fix: upgrade to 1.21.8 or later (3 fixed versions below)
Impact
Heap out-of-bounds read via corrupt nested BSON in field path error message
Patches
Fixed in 1.28.1 and 2.5.1.
Workarounds
Validate BSON prior to parsing.
References
https://jira.mongodb.org/browse/PHPC-2744
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mongodb Product | >= 1.15.0, < 1.21.8 | 1.21.8 |
| >= 2.2.0, < 2.5.1 | 2.5.1 | |
| >= 2.0.0, < 2.1.9 | 2.1.9 | |
| mongodb/mongodb-extension Product | >= 1.15.0, < 1.21.8 | 1.21.8 |
| >= 2.2.0, < 2.5.1 | 2.5.1 | |
| >= 2.0.0, < 2.1.9 | 2.1.9 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)