PT-2020-21480 · Mongodb · Mongoose

Published 2020-09-01 · Updated 2020-09-01

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mongoose versions prior to 4.3.6 mongoose versions prior to 3.8.39

Description The issue concerns remote memory exposure. In affected mongoose versions, attempting to save a number to a field of type Buffer allocates a chunk of uninitialized memory and stores it in the database.

Recommendations Update to version 4.3.6 or later. Update to version 3.8.39 or later.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

GHSA-R5XW-Q988-826M

Affected Products

Mongoose

References · 5

• https://osv.dev/vulnerability/GHSA-r5xw-q988-826m · Vendor Advisory
• https://github.com/Automattic/mongoose/issues/3764 · Note
• https://gist.github.com/ChALkeR/d4a8055625221b6e65f0 · Note
• https://npmjs.com/advisories/599 · Note
• https://gist.github.com/ChALkeR/440bc3dfcbd9b6da75c3 · Note