CVE-2020-12135

2020-04-2401:15:11

Google

osv.dev

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.7%

JSON

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.

CPENameOperatorVersion
mongo-c-driver-legacyeq0.4
mongo-c-driver-legacyeq0.3
mongo-c-driver-legacyeq0.5
mongo-c-driver-legacyeq0.1
mongo-c-driver-legacyeq0.5.2
mongo-c-driver-legacyeq0.7
mongo-c-driver-legacyeq0.3.1
mongo-c-driver-legacyeq0.6
mongo-c-driver-legacyeq0.2
mongo-c-driver-legacyeq0.5.1

Name	Operator	Version
mongo-c-driver-legacy	eq	0.4
mongo-c-driver-legacy	eq	0.3
mongo-c-driver-legacy	eq	0.5
mongo-c-driver-legacy	eq	0.1
mongo-c-driver-legacy	eq	0.5.2
mongo-c-driver-legacy	eq	0.7
mongo-c-driver-legacy	eq	0.3.1
mongo-c-driver-legacy	eq	0.6
mongo-c-driver-legacy	eq	0.2
mongo-c-driver-legacy	eq	0.5.1