Vulnerability · Published Jun 5, 2024 · Assigned by mongodb
CVE-2024-5629Out-of-bounds read in bson module of PyMongo
Medium 4.7
In plain English
A medium-severity out-of-bounds read in PyMongo from MongoDB Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | python-nose-docs | 1.3.7-31.module_el8.9.0+3700+efebe9fd | ALSA-2025:8419 |
| AlmaLinux:8 | python-pymongo-doc | 3.7.0-2.module_el8.10.0+3998+2cf36268 | ALSA-2025:8419 |
| AlmaLinux:8 | python-sqlalchemy-doc | 1.3.2-3.module_el8.10.0+3769+3838165b | ALSA-2025:8419 |
| AlmaLinux:8 | python-virtualenv-doc | 15.1.0-23.module_el8.10.0+3937+b6a3652f | ALSA-2025:8419 |
| AlmaLinux:8 | python3-PyMySQL | 0.10.1-2.module_el8.9.0+3700+efebe9fd | ALSA-2025:8419 |
| AlmaLinux:8 | python3-bson | 3.7.0-2.module_el8.10.0+3998+2cf36268 | ALSA-2025:8419 |
| AlmaLinux:8 | python3-distro | 1.4.0-2.module_el8.9.0+3700+efebe9fd | ALSA-2025:8419 |
| AlmaLinux:8 | python3-docs | 3.6.7-2.module_el8.9.0+3700+efebe9fd | ALSA-2025:8419 |
| AlmaLinux:8 | python3-docutils | 0.14-12.module_el8.9.0+3700+efebe9fd | ALSA-2025:8419 |
| AlmaLinux:8 | python3-nose | 1.3.7-31.module_el8.9.0+3700+efebe9fd | ALSA-2025:8419 |
| AlmaLinux:8 | python3-pygments | 2.2.0-22.module_el8.9.0+3700+efebe9fd | ALSA-2025:8419 |
| AlmaLinux:8 | python3-pymongo | 3.7.0-2.module_el8.10.0+3998+2cf36268 | ALSA-2025:8419 |
| AlmaLinux:8 | python3-pymongo-gridfs | 3.7.0-2.module_el8.10.0+3998+2cf36268 | ALSA-2025:8419 |
| AlmaLinux:8 | python3-scipy | 1.0.0-21.module_el8.9.0+3700+efebe9fd | ALSA-2025:8419 |
| AlmaLinux:8 | python3-sqlalchemy | 1.3.2-3.module_el8.10.0+3769+3838165b | ALSA-2025:8419 |
| AlmaLinux:8 | python3-virtualenv | 15.1.0-23.module_el8.10.0+3937+b6a3652f | ALSA-2025:8419 |
| AlmaLinux:8 | python3-wheel | 1:0.31.1-3.module_el8.9.0+3700+efebe9fd | ALSA-2025:8419 |
| AlmaLinux:8 | python3-wheel-wheel | 1:0.31.1-3.module_el8.9.0+3700+efebe9fd | ALSA-2025:8419 |
| AlmaLinux:8 | python36 | 3.6.8-39.module_el8.10.0+3769+3838165b | ALSA-2025:8419 |
| AlmaLinux:8 | python36-debug | 3.6.8-39.module_el8.10.0+3769+3838165b | ALSA-2025:8419 |
| AlmaLinux:8 | python36-devel | 3.6.8-39.module_el8.10.0+3769+3838165b | ALSA-2025:8419 |
| AlmaLinux:8 | python36-rpm-macros | 3.6.8-39.module_el8.10.0+3769+3838165b | ALSA-2025:8419 |
| Debian:12 | pymongo | 3.11.0-1+deb12u1 | DEBIAN-CVE-2024-5629 |
| Debian:13 | pymongo | 4.7.3-1 | DEBIAN-CVE-2024-5629 |
| Debian:14 | pymongo | 4.7.3-1 | DEBIAN-CVE-2024-5629 |
| PyPI | pymongo | 4.6.3 | GHSA-m87m-mmvp-v9qm |
| PyPI | pymongo | 4.6.3 | PYSEC-2026-1826 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1582+bc278001 | RLSA-2025:8419 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1592+61442852 | RLSA-2025:8419 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:8419 |
| Rocky Linux:8 | python-distro | 0:1.4.0-2.module+el8.10.0+1592+61442852 | RLSA-2025:8419 |
| Rocky Linux:8 | python-distro | 0:1.4.0-2.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Rocky Linux:8 | python-docs | 0:3.6.7-2.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Rocky Linux:8 | python-docs | 0:3.6.7-2.module+el8.10.0+1592+61442852 | RLSA-2025:8419 |
| Rocky Linux:8 | python-docutils | 0:0.14-12.module+el8.9.0+1531+a18208f5 | RLSA-2025:8419 |
| Rocky Linux:8 | python-docutils | 0:0.14-12.module+el8.10.0+1592+61442852 | RLSA-2025:8419 |
| Rocky Linux:8 | python-docutils | 0:0.14-12.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Rocky Linux:8 | python-nose | 0:1.3.7-31.module+el8.10.0+1592+61442852 | RLSA-2025:8419 |
| Rocky Linux:8 | python-nose | 0:1.3.7-31.module+el8.9.0+1531+a18208f5 | RLSA-2025:8419 |
| Rocky Linux:8 | python-nose | 0:1.3.7-31.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Rocky Linux:8 | python-pygments | 0:2.2.0-22.module+el8.9.0+1531+a18208f5 | RLSA-2025:8419 |
| Rocky Linux:8 | python-pygments | 0:2.2.0-22.module+el8.10.0+1592+61442852 | RLSA-2025:8419 |
| Rocky Linux:8 | python-pygments | 0:2.2.0-22.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Rocky Linux:8 | python-pymongo | 0:3.7.0-2.module+el8.10.0+1986+6cb2ea52 | RLSA-2025:8419 |
| Rocky Linux:8 | python-sqlalchemy | 0:1.3.2-3.module+el8.10.0+1602+b47e27fa | RLSA-2025:8419 |
| Rocky Linux:8 | python-sqlalchemy | 0:1.3.2-3.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Rocky Linux:8 | python-virtualenv | 0:15.1.0-23.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Rocky Linux:8 | python-wheel | 1:0.31.1-3.module+el8.9.0+1531+a18208f5 | RLSA-2025:8419 |
| Rocky Linux:8 | python-wheel | 1:0.31.1-3.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Rocky Linux:8 | python-wheel | 1:0.31.1-3.module+el8.10.0+1592+61442852 | RLSA-2025:8419 |
| Rocky Linux:8 | python36 | 0:3.6.8-39.module+el8.10.0+1592+61442852 | RLSA-2025:8419 |
| Rocky Linux:8 | python36 | 0:3.6.8-39.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Rocky Linux:8 | scipy | 0:1.0.0-21.module+el8.10.0+1592+61442852 | RLSA-2025:8419 |
| Rocky Linux:8 | scipy | 0:1.0.0-21.module+el8.10.0+1910+234ad790 | RLSA-2025:8419 |
| Ubuntu:22.04:LTS | pymongo | 3.11.0-1ubuntu0.22.04.1 | USN-6904-1 |
| Ubuntu:22.04:LTS | pymongo | 3.11.0-1ubuntu0.22.04.1 | UBUNTU-CVE-2024-5629 |
| Ubuntu:24.04:LTS | pymongo | 3.11.0-1ubuntu0.24.04.1 | UBUNTU-CVE-2024-5629 |
| Ubuntu:24.04:LTS | pymongo | 3.11.0-1ubuntu0.24.04.1 | USN-6904-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc | PyMongo | 0 – through 4.6.2 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L