cve-2024-6383
Vulnerability from cvelistv5
Published
2024-07-03 21:33
Modified
2024-10-04 15:02
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow
References
cna@mongodb.comhttps://jira.mongodb.org/browse/CDRIVER-5628
Impacted products
MongoDB Inclibbson
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-05T14:05:49.024613Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T14:07:34.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-10-04T15:02:53.248Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jira.mongodb.org/browse/CDRIVER-5628"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241004-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:libbson:0.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.98.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:beta1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:beta0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:beta0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:beta1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc3:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc4:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc6:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.12.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.13.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.13.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.14.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.14.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:beta:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:beta2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "libbson",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "1.27.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "selmelc"
        }
      ],
      "datePublic": "2024-07-03T21:33:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-04T12:49:04.148Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/CDRIVER-5628"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2024-6383",
    "datePublished": "2024-07-03T21:33:47.598Z",
    "dateReserved": "2024-06-27T08:43:40.268Z",
    "dateUpdated": "2024-10-04T15:02:53.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-6383\",\"sourceIdentifier\":\"cna@mongodb.com\",\"published\":\"2024-07-03T22:15:03.240\",\"lastModified\":\"2024-07-05T12:55:51.367\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n bson_string_append en MongoDB C Driver puede ser vulnerable a un desbordamiento del b\u00fafer donde la funci\u00f3n podr\u00eda intentar asignar un b\u00fafer demasiado peque\u00f1o y puede provocar da\u00f1os en la memoria del mont\u00f3n vecino. Este problema afecta a las versiones de Libbson anteriores a la 1.27.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]}],\"references\":[{\"url\":\"https://jira.mongodb.org/browse/CDRIVER-5628\",\"source\":\"cna@mongodb.com\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.