MEDIUM6.4

GHSA-32jf-h775-g29h

MongoDB Rust driver may issue unintended commands

Details

Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/mongodb

Introduced in: 2.0.0Fixed in: 2.8.2

Upgrade mongodb to 2.8.2 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2024-6382[ADVISORY]
https://github.com/mongodb/mongo-rust-driver/pull/1045[WEB]
https://github.com/mongodb/mongo-rust-driver/commit/8eac3bc6dc37a6d7667ed6c1a895c224e3ff47e1[WEB]
https://github.com/mongodb/mongo-rust-driver/commit/a3fe6c84ce6287348b1268f651fdac9fbed66187[WEB]
https://github.com/mongodb/mongo-rust-driver[PACKAGE]
https://jira.mongodb.org/browse/RUST-1881[WEB]