~ / search / GHSA-m87m-mmvp-v9qm

GHSA-m87m-mmvp-v9qm

PyMongo Out-of-bounds Read in the bson module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-5629

Packages

EcosystemPackageAffectedFixed in
PyPI pymongo < 4.6.3 4.6.3

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.

References

External links from the advisory. They lead to third-party sites.