CVE-2020-12135 — Integer Overflow or Wraparound in Mongodb C Driver
Severity
5.5MEDIUMNVD
EPSS
0.3%
top 42.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 24
Latest updateMay 24
Description
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages3 packages
Patches
🔴Vulnerability Details
4📋Vendor Advisories
4Debian▶
CVE-2020-12135: duo-unix - bson before 0.8 incorrectly uses int rather than size_t for many variables, para...↗2020
💬Community
6Bugzilla
▶
Bugzilla▶
CVE-2020-12135 libbson: bson: integer overflow in bson_ensure_space() parameter bytesNeeded [fedora-all]↗2020-05-12
Bugzilla▶
CVE-2020-12135 mongo-c-driver: bson: integer overflow in bson_ensure_space() parameter bytesNeeded [fedora-all]↗2020-05-12
Bugzilla▶
CVE-2020-12135 libbson: bson: integer overflow in bson_ensure_space() parameter bytesNeeded [epel-all]↗2020-05-12
Bugzilla▶
CVE-2020-12135 mongo-c-driver: bson: integer overflow in bson_ensure_space() parameter bytesNeeded [epel-all]↗2020-05-12