Your message dated Wed, 07 Oct 2026 07:04:55 +0000
with message-id <[email protected]>
and subject line Bug#1148967: fixed in pymongo 4.18.2-1
has caused the Debian Bug report #1148967,
regarding pymongo: CVE-2026-96747 CVE-2026-96748 CVE-2026-96749
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148967: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148967
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: pymongo
Version: 4.18.1-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for pymongo.
CVE-2026-96747[0]:
| The client-side field level encryption support in the MongoDB Python
| Driver can treat a key management endpoint value ending in ".sock"
| as a local Unix domain socket path rather than a remote host. A user
| with write access to the encryption key metadata stored in the
| database can cause an application using the driver to open
| connections to local sockets on the application host. Data sent over
| these connections is limited to the start of a TLS handshake, so no
| chosen content is transmitted.
CVE-2026-96748[1]:
| PyMongo's connection string parsing decodes percent-encoded
| characters in the host portion before the host list is separated on
| its delimiters. When an application places a hostname value supplied
| by an unauthenticated party into a connection string, that party may
| cause additional servers of their choosing to be added to the
| application's database client. The application may then send its
| authentication exchange and database operations to one of those
| servers, which can observe limited information and return altered
| results.
CVE-2026-96749[2]:
| An integer overflow in the BSON document encoding component of the
| MongoDB Python Driver's bundled native extension may occur when a
| single document is built from an unusually large amount of caller-
| supplied data. Size arithmetic is performed in a signed 32-bit type,
| and the guard meant to catch the overflow is written in a form whose
| behavior is not defined by the C language standard. A party with no
| privileges who can place a very large value into data that an
| application encodes may, depending on how the native extension was
| built, cause a write outside the bounds of an allocated buffer
| inside the application's own process.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-96747
https://www.cve.org/CVERecord?id=CVE-2026-96747
[1] https://security-tracker.debian.org/tracker/CVE-2026-96748
https://www.cve.org/CVERecord?id=CVE-2026-96748
[2] https://security-tracker.debian.org/tracker/CVE-2026-96749
https://www.cve.org/CVERecord?id=CVE-2026-96749
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: pymongo
Source-Version: 4.18.2-1
Done: Aryan Karamtoth <[email protected]>
We believe that the bug you reported is fixed in the latest version of
pymongo, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Aryan Karamtoth <[email protected]> (supplier of updated pymongo
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 07 Oct 2026 09:15:45 +0530
Source: pymongo
Architecture: source
Version: 4.18.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <[email protected]>
Changed-By: Aryan Karamtoth <[email protected]>
Closes: 1148967
Changes:
pymongo (4.18.2-1) unstable; urgency=medium
.
* New upstream version 4.18.2
* Introduce upstream fix for multiple CVEs (Closes: #1148967)
Checksums-Sha1:
5d839508ae3ffb52645ffa49fd086e2138ee4c3e 2565 pymongo_4.18.2-1.dsc
04ef077a377858d36b62d4ebe62deb60c4a2dc36 2824953 pymongo_4.18.2.orig.tar.gz
c3464a92f6e86fbadf8ea0956f972d2a1b4b46a6 7528 pymongo_4.18.2-1.debian.tar.xz
e2436ca9ba8f1ae5b5b20bd6cde13f6eb2d23f38 10044 pymongo_4.18.2-1_amd64.buildinfo
Checksums-Sha256:
2de8545aba8b41a3c3f92dbca14305ec8e89594084ba014683a6460bf5d7c5d1 2565
pymongo_4.18.2-1.dsc
2c71c1500a1f5387efa5212db008a9837ef36d2fee6cd6a8ef16160a970b384b 2824953
pymongo_4.18.2.orig.tar.gz
ccc6116057ba25ef481683752b8f18e8a9136ed4838abb8ba01ec04a32991977 7528
pymongo_4.18.2-1.debian.tar.xz
2447aed9c1351f62208dafe10e8bde4d9e0d8926156e3e2beac910e35c495855 10044
pymongo_4.18.2-1_amd64.buildinfo
Files:
8a600c5fa3abe04b356b51fbe1c6d6b1 2565 python optional pymongo_4.18.2-1.dsc
27df4de96872ffd7b38fe19a249f3d2a 2824953 python optional
pymongo_4.18.2.orig.tar.gz
b963bea089ebc7542b9a5c8de8bf1187 7528 python optional
pymongo_4.18.2-1.debian.tar.xz
cbceb7f704a4bddd76874ec7fb138ba7 10044 python optional
pymongo_4.18.2-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEen2TCCvRm6+oO340/pAHuO1kBCEFAmrF6aIACgkQ/pAHuO1k
BCENoBAAivrNIivd443hIqOgCkcUb7fX3O7rhKG2yktUckZIuzDqJ8ePSxerJXGC
a/RvQSPa2THD4/t/kYYITITT6W36z5dT+hlMdlIODkCiCv6XL2J4vv0L+x4ZsZ4c
BbAJmw0hgsbjYgjyEitRxPlf4HFnYyh4z8j1PZVvTV0qpiQfxQZWYQ989tCCrSA2
P8wlt93yZCuL2tZEhhGROmZK2CREaDU2Ub2yRtZuUxBw9LdLVNiSKpJMsZwIMVnM
1VzOcfTWEL00dRO30O5aaeVAL1HACpmIfco1ilzinJWQMwoGAp02m3SWCdWFYCCz
dgpepE+HQC7DUmtftwy6WCW7sKxIKwceJTrnt/gqbCcK90SH0IpWIiyUyMOJ6i0r
UFYdx7jiPNw3mCkGa4S0gmxU6ZvAIcFmXtPW+xyiHnM7uhQegdTcaU/NTBZTemx1
1kVtMiQNAUiP0PUnG76C2tE2t/u8un8bj/V+cKGWqmb4TaAtYKzL52KBuNlEIiwu
7thCAZvGxSV1gd9TNm2rqISO8h+8gmt+hxFMmT3/PUKfR7IqommpoUon4E0D+2Sy
OjnCDXiuKwJX3b2VxRIrI/bVdMlmuHfRmBFpvd1cQm8BeY3HkSB63VFS5Nu/HuNi
J6aVStVTd1paXJC6n1zC6ZwVU1wwCg031hENskgPkKsp+knNW9g=
=XFQ3
-----END PGP SIGNATURE-----
pgp_zxgBIy38e.pgp
Description: PGP signature
--- End Message ---
