This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-7610 →

DEBIAN-CVE-2020-7610

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsoty...

Original description

The description as published by the source.

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 node-mongodb

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.6+~cs11.12.19-1"}]}]

References

advisory security-tracker.debian.org