CVE-2023-0437

2024-01-1214:15:47

Debian Security Bug Tracker

security-tracker.debian.org

mongodb

c driver

infinite loop

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.1

Confidence

Low

EPSS

0.001

Percentile

17.0%

JSON

When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

OSVersionArchitecturePackageVersionFilename
Debian12allmongo-c-driver<= 1.23.1-1mongo-c-driver_1.23.1-1_all.deb
Debian11allmongo-c-driver<= 1.17.6-1mongo-c-driver_1.17.6-1_all.deb
Debian999allmongo-c-driver< 1.25.0-1mongo-c-driver_1.25.0-1_all.deb
Debian13allmongo-c-driver< 1.25.0-1mongo-c-driver_1.25.0-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	mongo-c-driver	<= 1.23.1-1	mongo-c-driver_1.23.1-1_all.deb
Debian	11	all	mongo-c-driver	<= 1.17.6-1	mongo-c-driver_1.17.6-1_all.deb
Debian	999	all	mongo-c-driver	< 1.25.0-1	mongo-c-driver_1.25.0-1_all.deb
Debian	13	all	mongo-c-driver	< 1.25.0-1	mongo-c-driver_1.25.0-1_all.deb