Vulnerability in MongoDB
CVE-2013-2132
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
EPSS: 0.026 (84.0th percentile) — read the EPSS interpretation.
Affected products
- Mongodb — versions 1.2.0, 1.4.0, 1.6.0
- Canonical Ubuntu_linux — versions 12.04, 12.10, 13.04
- Opensuse — versions 12.3
- N/a — versions n/a
Public proof-of-concept exploits
References
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_OSVDB, vdb-entry)
- secalert@redhat.com (x_refsource_MISC)
- secalert@redhat.com (Exploit, Patch, x_refsource_MISC)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_MISC)
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
- secalert@redhat.com (vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2013-2132?
- CVE-2013-2132 is a vulnerability in MongoDB. Published 2013-08-15.
- Is CVE-2013-2132 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.