Out-of-bounds read in mongo-python-driver - CVE-2024-21506

Vulnerability identifier: #VU89529

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-21506

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to out-of-bounds read in the bson module. A remote attacker can create a specially crafted file, trigger an out-of-bounds read error and read contents of memory on the system.

mongo-python-driver
Amazon Linux AMI
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
SUSE Package Hub 15
openSUSE Leap
openEuler
Fedora
python-pymongo
python3-bson
python2-bson
python-pymongo-debugsource
python3-pymongo
python2-pymongo
python2-pymongo-gridfs
python3-pymongo-gridfs
python-pymongo-debuginfo
python-pymongo-help
python3-pymongo-debuginfo
python2-pymongo-debuginfo

Install updates from vendor's website.

mongo-python-driver - update to 4.6.3
python-pymongo - update to 3.9.0-6
python3-bson - update to 3.9.0-6
python2-bson - update to 3.9.0-6
python-pymongo-debugsource - update to 3.9.0-6
python3-pymongo - update to 3.9.0-6
python2-pymongo - update to 3.9.0-6
python2-pymongo-gridfs - update to 3.9.0-6
python3-pymongo-gridfs - update to 3.9.0-6
python-pymongo-debuginfo - update to 3.9.0-6
python-pymongo-help - update to 3.9.0-6
python-pymongo - update to 3.10.1-5
python3-pymongo - update to 3.11.0-150300.3.3.1
python3-pymongo-debuginfo - update to 3.11.0-150300.3.3.1
python-pymongo-debuginfo - update to 3.11.0-150300.3.3.1
python-pymongo-debugsource - update to 3.11.0-150300.3.3.1
python2-pymongo-debuginfo - update to 3.11.0-150300.3.3.1
python2-pymongo - update to 3.11.0-150300.3.3.1
python-pymongo - update to 4.9.1-3.fc43

• https://security.snyk.io/vuln/SNYK-PYTHON-PYMONGO-6370597
• https://gist.github.com/keltecc/62a7c2bf74a997d0a7b48a0ff3853a03
• https://github.com/mongodb/mongo-python-driver/commit/56b6b6dbc267d365d97c037082369dabf37405d2

• SUSE update for python-pymongo
• openEuler update for python-pymongo
• SUSE update for python-pymongo
• Amazon Linux AMI update for python-pymongo
• Fedora 43 update for python-pymongo