Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
36045798 by Salvatore Bonaccorso at 2026-10-09T20:41:19+02:00
Add another batch of mongodb driver CVEs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -813,13 +813,27 @@ CVE-2026-106432 (The BSON encoder in the MongoDB PHP
Driver converts a string le
NOTE: https://jira.mongodb.org/browse/PHPC-2741
NOTE: Fixed by:
https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260
(2.5.4, 2.1.11, 1.21.11)
CVE-2026-106431 (An off-by-one error in the BSON bulk document writer in the
MongoDB C ...)
- TODO: check
+ - mongo-c-driver 2.5.6-1
+ NOTE: https://jira.mongodb.org/browse/CDRIVER-6418
+ NOTE: Fixed by:
https://github.com/mongodb/mongo-c-driver/commit/bddaffdabdb449d8ee5e8b28f9a82afd03cd42aa
(2.5.6)
+ NOTE: Fixed by:
https://github.com/mongodb/mongo-c-driver/commit/70d96b8f28974e02cc966a00953dc3d8c308b8ff
(1.30.13)
CVE-2026-106430 (The MongoDB C++ Driver discards content after an embedded NUL
byte in ...)
- TODO: check
+ - mongo-cxx-driver 4.6.1-1
+ NOTE: https://jira.mongodb.org/browse/CXX-3551
+ NOTE: https://jira.mongodb.org/browse/CXX-3552
+ NOTE: Fixed by:
https://github.com/mongodb/mongo-cxx-driver/commit/dabc8ff93b616747c64007183f04399d9636468d
(4.6.0)
+ NOTE: Fixed by:
https://github.com/mongodb/mongo-cxx-driver/commit/5a6efb4ae260a3dd6d243a1a1b1e4d788e392416
(4.6.1)
CVE-2026-106429 (An integer underflow in the KMS endpoint-parsing logic of
MongoDB libm ...)
- TODO: check
+ - libmongocrypt 1.20.5-1
+ NOTE: https://jira.mongodb.org/browse/MONGOCRYPT-986
+ NOTE: Fixed by:
https://github.com/mongodb/libmongocrypt/commit/f2ea9f97dff40eb8b470a4fc3d407bafb4650d88
(1.20.5)
+ NOTE: Fixed by:
https://github.com/mongodb/libmongocrypt/commit/1450714452daaaa9da29359ab6a6b1a0c3a1fa47
(1.20.5)
+ NOTE: Fixed by:
https://github.com/mongodb/libmongocrypt/commit/03d09f07bb32f9387aec823444cd7bb6d41cddad
(1.20.5)
CVE-2026-106428 (An out-of-bounds read in SCRAM authentication response
parsing in the ...)
- TODO: check
+ - mongo-c-driver 2.4.0-1
+ NOTE: https://jira.mongodb.org/browse/CDRIVER-6370
+ NOTE: Fixed by:
https://github.com/mongodb/mongo-c-driver/commit/9655909e15c83149c0fc68e53f38e696bbd23569
(2.4.0)
+ NOTE: Fixed by:
https://github.com/mongodb/mongo-c-driver/commit/57054353fdf79383341de21540a2adab196eb6a4
(1.30.13)
CVE-2026-106177 (A kernel buffer overflow vulnerability in HP Sure Click
versions prior ...)
TODO: check
CVE-2026-106126 (A command injection vulnerability in the Active Directory
Events Liste ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3604579884e9e01d0174af27bb1d3e600f0b589c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3604579884e9e01d0174af27bb1d3e600f0b589c
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
