Deserialization of Untrusted Data in bson - bson

Description

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.

Recommendation

Update the bson package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.4
• Patched version(s): 1.1.4

References

• GHSA-4jwp-vfvf-657p
• CVE-2019-2391
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Deserialization of Untrusted Data in bson - CVE-2020-7610
• bson-objectid contains Improper input validation - CVE-2019-19729
• Insufficient Verification of Data Authenticity in Eclipse Theia - CVE-2019-17636
• Sensitive Data Exposure in parse-server - CVE-2019-1020013

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

bson