CVE-2023-0437

NameCVE-2023-0437
DescriptionWhen calling bson_utf8_validateĀ on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mongo-c-driver (PTS)bullseye1.17.6-1vulnerable
bookworm1.23.1-1vulnerable
sid, trixie1.29.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mongo-c-driversource(unstable)1.25.0-1

Notes

[bookworm] - mongo-c-driver <no-dsa> (Minor issue)
[bullseye] - mongo-c-driver <no-dsa> (Minor issue)
[buster] - mongo-c-driver <ignored> (Minor issue)
https://jira.mongodb.org/browse/CDRIVER-4747

Search for package or bug name: Reporting problems