What is GHSA-4jwp-vfvf-657p?

GHSA-4jwp-vfvf-657p is a security advisory published by GitHub Security Advisories with Medium severity. Deserialization of Untrusted Data in bson

Which CVE IDs does GHSA-4jwp-vfvf-657p cover?

GHSA-4jwp-vfvf-657p covers the following CVE IDs: CVE-2019-2391. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4jwp-vfvf-657p?

GHSA-4jwp-vfvf-657p has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-4jwp-vfvf-657p?

GHSA-4jwp-vfvf-657p affects 1 product, including: npm/bson:\u003c 1.1.4.

GHSA-4jwp-vfvf-657pMediumCVSS 5.4

Deserialization of Untrusted Data in bson

Vendor

GitHub Security Advisories

Published

February 10, 2022

Last Modified

June 20, 2023

🔗 CVE IDs covered (1)

CVE-2019-2391 →

📋 Description

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.

🎯 Affected products1

npm/bson:< 1.1.4

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2019-2391
https://github.com/mongodb/js-bson/releases/tag/v1.1.4
https://github.com/advisories/GHSA-4jwp-vfvf-657p