p PatchFirst

CVE-2023-0437

CVE-2023-0437 · MongoDB client C Driver may infinitely loop when validating certain BSON input data

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

CVSS 5.3 · Medium · EPSS 1.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • mongodb c driver

    Versions
    • ≥ 1.0.0, < 1.25.0: Affected (custom)

    Update to 1.25.0

  • libbson-xs-perl Debian:12

    Versions
    • 0.8.4-2
    Affected ranges
    • ECOSYSTEM: < 0.8.4-2+deb12u1

    Update to 0.8.4-2+deb12u1

  • mongo-c-driver Debian:12

    Versions
    • 1.23.1-1
    Affected ranges
    • ECOSYSTEM: < 1.23.1-1+deb12u1

    Update to 1.23.1-1+deb12u1

  • mongo-c-driver Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.25.0-1

    Update to 1.25.0-1

  • mongo-c-driver Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.25.0-1

    Update to 1.25.0-1

Original sources

Check your server →