Deserialization of Untrusted Data in bson (GHSA-4jwp-vfvf-657p)

Description

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.

Recommendation

Update the bson package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.4
• Patched version(s): 1.1.4

References

• GHSA-4jwp-vfvf-657p
• CVE-2019-2391
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Deserialization of Untrusted Data in bson - CVE-2020-7610
• Prototype Pollution in js-data (GHSA-c6h4-gc3f-hgjq) - CVE-2021-23574
• Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation (GHSA-rg3q-jxmp-pvjj) - CVE-2019-11004
• Materialize-css vulnerable to Cross-site Scripting in tooltip component (GHSA-98f7-p5rc-jx67) - CVE-2019-11002

Tags:

npm

bson