Uploaded image for project: 'Go Driver'
  1. Go Driver
  2. GODRIVER-1923

BSON cstrings are not properly validated

    XMLWordPrintable

Details

    • Bug
    • Status: Closed
    • Major - P3
    • Resolution: Fixed
    • None
    • 1.5.1
    • None
    • None

    Description

      BSON marshalling functions would incorrectly handle null bytes embedded in BSON key names and the pattern/options fields of a BSON regex value. BSON marshalling functions now correctly validate and error if there is an embedded null byte in BSON key names or the pattern/options fields of a BSON regex value.

      CVE ID: CVE-2021-20329

      Title: Specific cstrings input may not be properly validated in the MongoDB Go Driver
      Description: Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.
      CVSS score: 6.8
      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
      Affected products and versions, MongoDB Go Driver versions <= 1.5.0
      Underlying operating systems affected: All

      Attachments

        Issue Links

          Activity

            People

              divjot.arora@mongodb.com Divjot Arora
              divjot.arora@mongodb.com Divjot Arora
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: