Critical Security Update for Python 3.6: Out-of-Bounds Read Vulnerability in bson Module
Summary
ALSA-2025:8419: Low: python36:3.6 security update. Affects python-nose-docs versions < 1.3.7-31.module_el8.9.0+3700+efebe9fd. Fixed in 1.3.7-31.module_el8.9.0+3700+efebe9fd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various system calls and libraries, making it a popular choice for developers. The affected package, python36, is a version of Python that includes essential libraries and modules, including pymongo, which interfaces with MongoDB databases. This vulnerability specifically affects the bson module within pymongo, which is responsible for handling BSON data formats.
Vulnerability Detail
The vulnerability identified as CVE-2024-5629 is an out-of-bounds read in the bson module of python-pymongo. This flaw can lead to unauthorized access to sensitive data or application crashes, potentially allowing attackers to exploit the system. The issue arises from improper handling of data, which can be triggered by malformed BSON documents, leading to memory access violations.
How To Fix
Minimum fixed version
1.3.7-31.module_el8.9.0+3700+efebe9fd
This is the first release that contains the fix.
sudo dnf update python-nose-docsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the affected modules or implementing input validation to prevent malformed BSON documents from being processed. However, this is not a permanent solution and should only be used until the packages are updated.
Conclusion
The vulnerability CVE-2024-5629 in the bson module of python-pymongo poses significant security risks. It is crucial to update the affected packages to their patched versions to mitigate these risks. Temporary workarounds can be implemented, but they should not replace the need for a proper update.
See every vulnerability recorded for python-nose-docs →
FAQ
CVE-2024-5629 is a security vulnerability in the bson module of python-pymongo that allows for out-of-bounds reads, potentially leading to unauthorized data access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive data, application crashes, and potential exploitation by attackers.
Yes, patched versions of the affected packages are available. Updating to these versions will resolve the vulnerability.
If immediate updates are not possible, implement input validation and restrict access to the affected modules as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python-nose-docs.
