PT-2020-2039 · Mongodb · Bson

Xiaofen9 · Published 2020-03-23 · Updated 2021-05-07 · CVE-2020-7610

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions bson versions prior to 1.1.4

Description The issue is related to the deserialization of untrusted data in the bson package. It occurs when the package ignores an unknown value for an object's bsotype or bsontype, leading to incorrect serialization of the object as a document instead of the intended BSON type. This can potentially allow a remote attacker to execute arbitrary code.

Recommendations For versions prior to 1.1.4, update to version 1.1.4 or later to resolve the issue. As a temporary workaround, consider restricting the deserialization of untrusted data to minimize the risk of exploitation. Avoid using unknown or untrusted values for an object's bsotype or bsontype until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2020-01664

CVE-2020-7610

GHSA-V8W9-2789-6HHR

SNYK-JS-BSON-561052

Affected Products

Bson

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2020-7610 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-7610 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7610 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7610 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01664 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-7610 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7610 · Security Note
• https://snyk.io/vuln/SNYK-JS-BSON-561052 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7610 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v8w9-2789-6hhr · Vendor Advisory
• https://github.com/mongodb/js-bson/commit/3809c1313a7b2a8001065f0271199df9fa3d16a8 · Note
• https://t.me/cvenotify/2259 · Telegram Post