Описание
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.
A flaw was found in the MongoDB C Driver. This vulnerability, a heap buffer overflow, occurs in the client-side authentication process when handling unusually large usernames. An attacker who can control the driver's connection settings could exploit this to cause the application using the driver to crash, leading to a denial of service. Exploitation requires the optional external SASL (Simple Authentication and Security Layer) authentication backend to be enabled and configured.
Отчет
This vulnerability is rated as Moderate severity because triggering the issue requires an application to use an optional external SASL authentication mechanism and allows an attacker with control over connection parameters to induce an application crash. In standard Red Hat environments, applications embedding the driver generally manage connection parameters within trusted boundaries rather than exposing them directly to arbitrary user input. The impact is strictly confined to a denial of service, with no compromise of data confidentiality or system integrity.
Меры по смягчению последствий
Mitigation: Fedora and EPEL users running mongo-c-driver are not affected as the shipped version 1.30.13 includes the fix introduced in version 1.30.10. Red Hat products do not ship the MongoDB C Driver and are not affected by this vulnerability.
Дополнительная информация
Статус:
EPSS
4.7 Medium
CVSS3
Связанные уязвимости
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.
A size check in the client-side authentication path of the MongoDB C D ...
EPSS
4.7 Medium
CVSS3