Out-of-bounds read in bson module of PyMongo
CVE-2024-5629

4.7MEDIUM

Key Information:

Vendor
MongoDB
Status
Pymongo
Vendor
CVE Published:
5 June 2024

Summary

An out-of-bounds read was identified in the bson module of PyMongo versions prior to 4.6.3. This vulnerability permits the deserialization of malformed BSON data sent from a server, which can trigger an exception potentially exposing arbitrary application memory. The implications of this vulnerability could lead to unauthorized access to sensitive data or system instability. Users are advised to upgrade to the latest version of PyMongo to mitigate risks associated with this vulnerability.

Affected Version(s)

PyMongo 0 <= 4.6.2

References

https://jira.mongodb.org/browse/PYTHON-4305
release-notes
https://lists.debian.org/debian-lts-announce/2024/06/msg0...

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.