ADVISORIES

• CVE-2015-4412 (NVD)
• GHSA-h6rj-8r3c-9gpj
• Vendor Advisory

GEM

bson

SEVERITY

CVSS v3.x: 9.8 (Critical)

PATCHED VERSIONS

• ~> 1.12.3
• >= 3.0.4

DESCRIPTION

A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.

RELATED

• https://github.com/mongodb/mongo-ruby-driver/compare/6ae981167759d5819ba3d41e374e5b2af5b79077~1...9859a3ab9773a8a883eb8438b665a921cc991c71
• https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7