Patch Ticker

MongoDB C Driver memory leak and information disclosure flaws

A database connection part can make programs freeze or leak information.

Summary

The MongoDB C Driver can leak memory until the application runs out, read memory outside a buffer and crash the process, disclose uninitialized memory, or silently process only part of the data. Applications that connect to an attacker-controlled database server, and 32-bit builds that parse untrusted BSON data, are affected.

Affected when

  • application connects to an attacker-controlled database server
  • 32-bit builds (one CVE only)

What to do

No fixed version is named in the sources. Versions 1.25.0 through 1.30.14 and 2.0.0 through 2.5.7 are affected, so check that your driver is newer than these and read the vendor's advisory.

Products and platforms

  • C Driver

CVE IDs

Sources

Times

First published

First seen