CVE-2013-2132

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-2132
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=710597
http://lists.opensuse.org/opensuse-updates/2013-06/msg00180.html
http://seclists.org/oss-sec/2013/q2/447
http://ubuntu.com/usn/usn-1897-1 Vendor Advisory
http://www.debian.org/security/2013/dsa-2705
http://www.osvdb.org/93804
http://www.securityfocus.com/bid/60252
https://github.com/mongodb/mongo-python-driver/commit/a060c15ef87e0f0e72974c7c0e57fe811bbd06a2 Exploit Patch
https://jira.mongodb.org/browse/PYTHON-532
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:2.4.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:2.4.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:2.4.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:2.4.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:2.5.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
History

13 Feb 2023, 04:42

Type Values Removed Values Added
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=969560', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=969560', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2013-2132', 'name': 'https://access.redhat.com/security/cve/CVE-2013-2132', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:1170', 'name': 'https://access.redhat.com/errata/RHSA-2013:1170', 'tags': [], 'refsource': 'MISC'}
Summary CVE-2013-2132 pymongo: null pointer when decoding invalid DBRef bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."

02 Feb 2023, 18:17

Type Values Removed Values Added
Summary bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef." CVE-2013-2132 pymongo: null pointer when decoding invalid DBRef
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=969560 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2013-2132 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:1170 -
Information

Published : 2013-08-15 17:55

Updated : 2023-12-10 11:16

NVD link : CVE-2013-2132

Mitre link : CVE-2013-2132

CVE.ORG link : CVE-2013-2132

JSON object : View

Products Affected

canonical

  • ubuntu_linux

opensuse

  • opensuse

mongodb

  • mongodb
CWE
NVD-CWE-Other