Mongodb Bson vulnerabilities

CVE-2020-7610 [CRITICAL] CWE-502 CVE-2020-7610: All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package w All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

CVE-2015-4412 [CRITICAL] CWE-400 bson is vulnerable to denial of service due to incorrect regex validation bson is vulnerable to denial of service due to incorrect regex validation BSON injection vulnerability in the legal function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.

CVE-2015-4411 [HIGH] CVE-2015-4411: The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped al The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.

CVE-2018-13863 [HIGH] CWE-185 js-bson vulnerable to REDoS js-bson vulnerable to REDoS The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.

CVE-2019-2391 [MEDIUM] CWE-502 Deserialization of Untrusted Data in bson Deserialization of Untrusted Data in bson Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.