CVE-2019-2391

Name	CVE-2019-2391
Description	Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-mongodb (PTS)	bullseye	3.6.4+~cs11.13.19-1	fixed
	sid, bookworm	3.6.4+~cs11.13.19-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
node-mongodb	source	experimental	3.5.5+~cs11.12.19-1
node-mongodb	source	buster	3.1.13+~3.1.11-2+deb10u1
node-mongodb	source	(unstable)	3.5.6+~cs11.12.19-1

Fixed in js-bson v1.1.4 included in 3.5.5+~cs11.12.19