p PatchFirst

CVE-2020-7610

CVE-2020-7610

This page contains facts from public vulnerability sources. Check the original advisory before updating.

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

CVSS 9.8 · Critical · EPSS 2.3% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • bson

    Versions
    • all versions before 1.1.4: Affected

    No fix published

  • node-mongodb Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.5.6+~cs11.12.19-1

    Update to 3.5.6+~cs11.12.19-1

  • bson npm

    Affected ranges
    • SEMVER: < 1.1.4

    Update to 1.1.4

  • node-mongodb Ubuntu:20.04:LTS

    Versions
    • 3.3.1+~3.2.7-1
    • 3.3.2+~3.2.7-1
    • 3.3.3+~3.2.7-1
    • 3.3.5+~3.2.7-1
    • 3.4.0+~3.2.7-1
    • 3.4.1+~3.2.7-1
    • 3.5.0+~3.2.7-1
    • 3.5.2+~3.2.7-1
    • 3.5.3+~3.2.7-1
    • 3.5.5+~3.2.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →