CVE-2020-12135
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-12135
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-12135.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2020-12135
- Related
- Published
- 2020-04-24T01:15:11Z
- Modified
- 2024-10-12T05:39:03.000029Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
bson before 0.8 incorrectly uses int rather than sizet for many variables, parameters, and return values. In particular, the bsonensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.
- References
-
- https://bugs.launchpad.net/ubuntu/+source/whoopsie/+bug/1872560
- https://github.com/10gen-archive/mongo-c-driver-legacy/commit/1a1f5e26a4309480d88598913f9eebf9e9cba8ca#diff-f7d29a680148f52d6601f59ed787f577
- https://launchpadlibrarian.net/474887364/bson-fix-overflow.patch
- https://usn.ubuntu.com/4450-1/
- https://security-tracker.debian.org/tracker/CVE-2020-12135
Affected packages
Debian:11 / duo-unix
Package
- Name
- duo-unix
- Purl
- pkg:deb/debian/duo-unix?arch=source
Debian:12 / duo-unix
Package
- Name
- duo-unix
- Purl
- pkg:deb/debian/duo-unix?arch=source
Debian:13 / duo-unix
Package
- Name
- duo-unix
- Purl
- pkg:deb/debian/duo-unix?arch=source
Git / github.com/10gen-archive/mongo-c-driver-legacy
Affected ranges
- Type
- GIT
- Repo
- https://github.com/10gen-archive/mongo-c-driver-legacy
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- GIT
- Repo
- https://github.com/mongodb/mongo-c-driver
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed