Aller au contenu
Moyenne 6.9

Plaintext exposure of encrypted fields via ANSI code-page corruption of database name

CVE-2026-114650 Première détection SecPulse

Résumé

A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fa...

Paquets affectés

ÉcosystèmePaquetConcernéesCorrigé
MongoDB C# Driver
≥ 2.10.0, < 3.13.0
3.13.0
MongoDB MongoDB.Libmongocrypt NuGet package
1.0.0 – 1.12.0
—
Description d'origine La description telle que publiée par la source (souvent en anglais).

A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fails to associate the operation with its configured encryption rules and the operation proceeds without an error being raised. An application user with the ability to write data through an affected application can therefore have sensitive fields persisted in plaintext, defeating the confidentiality guarantee that client-side encryption is intended to provide. No integrity or availability impact was observed.

Source: CVE.org (CVE Program・cvelistV5) NVD

Références

Nous utilisons des cookies pour l'analyse d'audience et la mesure publicitaire. Ce réglage s'applique à tous les sites de Game co., Ltd. En savoir plus