Skip to content

[GHSA-x43h-8pfv-xx24] Improve advisory details: reference incomplete fix for CVE-2024-6383 #6790

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
decsecre583 wants to merge 1 commit into
base: decsecre583/advisory-improvement-6790
Choose a base branch
from
+2 −2
Open

[GHSA-x43h-8pfv-xx24] Improve advisory details: reference incomplete fix for CVE-2024-6383 #6790

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions advisories/unreviewed/2025/03/GHSA-x43h-8pfv-xx24/GHSA-x43h-8pfv-xx24.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"aliases": [
"CVE-2025-0755"
],
"details": "The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16",
"details": "The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16. NOTE: this vulnerability exists because of an incomplete fix for CVE-2024-6383. This vulnerability addresses buffer overflow in the broader set of `bson_append` functions. A related buffer overflow in `bson_string_append` was previously patched in CVE-2024-6383(https://github.com/advisories/GHSA-w25p-2jj3-j5vr), which did not cover all append operations.",
"severity": [
{
"type": "CVSS_V3",
Expand Down Expand Up @@ -45,4 +45,4 @@
"github_reviewed_at": null,
"nvd_published_at": "2025-03-18T09:15:11Z"
}
}
}