Deserialization of Untrusted Data in bson - bson

Description

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.

Recommendation

Update the bson package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.4
• Patched version(s): 1.1.4

References

• GHSA-4jwp-vfvf-657p
• CVE-2019-2391
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Deserialization of Untrusted Data in bson - CVE-2020-7610
• bson-objectid contains Improper input validation - CVE-2019-19729
• Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript - CVE-2019-16763
• TaffyDB can allow access to any data items in the DB - taffy - CVE-2019-10790

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

bson