Out-of-bounds read in mongo-python-driver - CVE-2024-5629

Vulnerability identifier: #VU98510

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-5629

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the bson module. A remote attacker can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

mongo-python-driver
IBM Security QRadar Network Threat Analytics
Storage Protect Plus Server
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Ubuntu
Fedora
python3-bson (Ubuntu package)
python3-bson-ext (Ubuntu package)
python-bson (Ubuntu package)
python-bson-ext (Ubuntu package)
python3-PyMySQL
python3-docutils
python3-wheel-wheel
python3-wheel
python3-scipy
python-sqlalchemy-doc
python3-sqlalchemy
python-nose-docs
python3-nose
python3-distro
python3-pygments
python3-docs
python36-rpm-macros
python36
python36-debug
python36-devel
python3-bson
python3-pymongo
python3-pymongo-gridfs
python-pymongo-doc
python3-pymongo-doc
python-pymongo
python-virtualenv-doc
python3-virtualenv
IBM Watson Assistant for IBM Cloud Pak for Data

Install updates from vendor's website.

mongo-python-driver - update to 4.6.3
python3-bson (Ubuntu package) - addressed in versions Ubuntu Pro, 3.10.1-0ubuntu2.1, 3.11.0-1ubuntu0.22.04.1, 3.11.0-1ubuntu0.24.04.1
python3-bson-ext (Ubuntu package) - addressed in versions Ubuntu Pro, 3.10.1-0ubuntu2.1, 3.11.0-1ubuntu0.22.04.1, 3.11.0-1ubuntu0.24.04.1
python-bson (Ubuntu package) - update to Ubuntu Pro
python-bson-ext (Ubuntu package) - update to Ubuntu Pro
python3-PyMySQL - update to 0.10.1-2
python3-docutils - update to 0.14-12
python3-wheel-wheel - update to 0.31.1-3
python3-wheel - update to 0.31.1-3
python3-scipy - update to 1.0.0-21
python-sqlalchemy-doc - update to 1.3.2-3
python3-sqlalchemy - update to 1.3.2-3
python-nose-docs - update to 1.3.7-31
python3-nose - update to 1.3.7-31
IBM Security QRadar Network Threat Analytics - update to 1.4.0
python3-distro - update to 1.4.0-2
python3-pygments - update to 2.2.0-22
python3-docs - update to 3.6.7-2
python36-rpm-macros - update to 3.6.8-39
python36 - update to 3.6.8-39
python36-debug - update to 3.6.8-39
python36-devel - update to 3.6.8-39
python3-bson - addressed in versions 3.7.0-2.0.1, 4.6.3-2
python3-pymongo - addressed in versions 3.7.0-2.0.1, 4.6.3-2
python3-pymongo-gridfs - addressed in versions 3.7.0-2.0.1, 4.6.3-2
python-pymongo-doc - update to 3.7.0-2.0.1
python3-pymongo-doc - update to 4.6.3-2
python-pymongo - update to 4.9.1-3.fc43
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.0.3
Storage Protect Plus Server - update to 10.1.18
python-virtualenv-doc - update to 15.1.0-23
python3-virtualenv - update to 15.1.0-23

• https://jira.mongodb.org/browse/PYTHON-4305
• https://lists.debian.org/debian-lts-announce/2024/06/msg00007.html

• Denial of service in PyMongo
• IBM Watson Assistant for IBM Cloud Pak for Data update for PyMongo
• Ubuntu update for pymongo
• Fedora 43 update for python-pymongo
• Anolis OS update for python-pymongo
• Red Hat Enterprise Linux 8 update for the python36:3.6 module
• Anolis OS update for python36:3.6 module
• Multiple vulnerabilities in IBM Security QRadar Network Threat Analytics
• Multiple vulnerabilities in IBM Storage Protect Plus Server