CVE-2023-0437 MongoDB client C Driver may infinitely loop when validating certain BSON input data

2024-01-1213:33:39

CWE-835

mongodb

www.cve.org

mongodb

c driver

infinite loop

validate

bson input data

security issue

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

17.0%

JSON

When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MongoDB C Driver",
    "vendor": "MongoDB Inc",
    "versions": [
      {
        "lessThan": "1.25.0",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "custom"
      }
    ]
  }
]