GHSA-32jf-h775-g29h

MongoDB Rust driver may issue unintended commands

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-6382

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	mongodb	>= 2.0.0, < 2.8.2	2.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-6382 advisory
https://github.com/mongodb/mongo-rust-driver/pull/1045 web
https://github.com/mongodb/mongo-rust-driver/commit/8eac3bc6dc37a6d7667ed6c1a895c224e3ff47e1 web
https://github.com/mongodb/mongo-rust-driver/commit/a3fe6c84ce6287348b1268f651fdac9fbed66187 web
https://github.com/mongodb/mongo-rust-driver package
https://jira.mongodb.org/browse/RUST-1881 web