Описание
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | needs-triage | |
| esm-apps/noble | needs-triage | |
| esm-apps/resolute | not-affected | |
| jammy | needs-triage | |
| noble | needs-triage | |
| questing | ignored | end of life, was needs-triage |
| resolute | not-affected | 2.2.2-1 |
| upstream | released | 2.2.0-1 |
Показывать по
Ссылки на источники
EPSS
7.8 High
CVSS3
Связанные уязвимости
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.
The MongoDB C Driver's Cyrus SASL integration performs unsafe string c ...
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.
EPSS
7.8 High
CVSS3