Skip to main content

Out-of-bounds Read

CVE-2024-21506

Medium
5.2/10

Summary

In package pymongo versions 0.4pre through 4.6.2 are vulnerable to Out-of-bounds Read in the ''bson'' module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to the buffer and throws an exception with a string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.

  • HIGH
  • LOCAL
  • LOW
  • CHANGED
  • REQUIRED
  • NONE
  • LOW
  • LOW

CWE-125 - Out-of-Bounds Read

Out-of-bounds read is a vulnerability that allows access to memory beyond the authorized accessible location. Such a vulnerability compromises the confidentiality of the trusted environment in the application and enables an attacker to launch further attacks by leveraging the exposed information.

References

Advisory Timeline

  • Published