An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a…
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- MongoDB
- Product
- MongoDB
- CVSS
- 3.7
- Exposure class
- Database
Why it ranks 5 (Routine)
- Product class: database
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.