Details
-
Bug
-
Resolution: Fixed
-
Major - P3
-
None
-
None
-
None
Description
BSON marshalling functions would incorrectly handle null bytes embedded in BSON key names and the pattern/options fields of a BSON regex value. BSON marshalling functions now correctly validate and error if there is an embedded null byte in BSON key names or the pattern/options fields of a BSON regex value.
CVE ID: CVE-2021-20329
Title: Specific cstrings input may not be properly validated in the MongoDB Go Driver
Description: Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.
CVSS score: 6.8
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products and versions, MongoDB Go Driver versions <= 1.5.0
Underlying operating systems affected: All
Attachments
Issue Links
- related to
-
GODRIVER-2083 Test serialization of BSON with embedded null bytes in strings
-
- Closed
-