Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. go.mongodb.org/mongo-driver
  4. ›
  5. CVE-2021-20329

CVE-2021-20329: go.mongodb.org/mongo-driver improperly validates cstrings when marshalling Go objects into BSON

June 15, 2021 (updated September 17, 2024)

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.

References

  • github.com/advisories/GHSA-f6mq-5m25-4r72
  • github.com/mongodb/mongo-go-driver
  • github.com/mongodb/mongo-go-driver/commit/2aca31d5986a9e1c65a92264736de9fdc3b9b4ca
  • github.com/mongodb/mongo-go-driver/pull/622
  • github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1
  • jira.mongodb.org/browse/GODRIVER-1923
  • nvd.nist.gov/vuln/detail/CVE-2021-20329
  • pkg.go.dev/vuln/GO-2021-0112

Code Behaviors & Features

Detect and mitigate CVE-2021-20329 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.5.1

Fixed versions

  • 1.5.1

Solution

Upgrade to version 1.5.1 or above.

Impact 6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-1287: Improper Validation of Specified Type of Input
  • CWE-20: Improper Input Validation

Source file

go/go.mongodb.org/mongo-driver/CVE-2021-20329.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:16 +0000.