module: go.mongodb.org/mongo-driver
package: go.mongodb.org/mongo-driver/x/bsonx/bsoncore
versions:
  - fixed: v1.5.1
description: |
    Due to improper input sanitization when marshalling Go objects into BSON, a maliciously constructed
    Go structure could allow an attacker to inject additional fields into a MongoDB document. Users are
    affected if they use this package to handle untrusted user input.
published: 2021-07-28T18:08:05Z
cves:
  - CVE-2021-20329
ghsas:
  - GHSA-f6mq-5m25-4r72
symbols:
  - AppendHeader
  - AppendRegex
derived_symbols:
  - AppendArrayElement
  - AppendArrayElementStart
  - AppendBinaryElement
  - AppendBooleanElement
  - AppendCodeWithScopeElement
  - AppendDBPointerElement
  - AppendDateTimeElement
  - AppendDecimal128Element
  - AppendDocumentElement
  - AppendDocumentElementStart
  - AppendDoubleElement
  - AppendInt32Element
  - AppendInt64Element
  - AppendJavaScriptElement
  - AppendMaxKeyElement
  - AppendMinKeyElement
  - AppendNullElement
  - AppendObjectIDElement
  - AppendRegexElement
  - AppendStringElement
  - AppendSymbolElement
  - AppendTimeElement
  - AppendTimestampElement
  - AppendUndefinedElement
  - AppendValueElement
  - ArrayBuilder.AppendArray
  - ArrayBuilder.AppendBinary
  - ArrayBuilder.AppendBoolean
  - ArrayBuilder.AppendCodeWithScope
  - ArrayBuilder.AppendDBPointer
  - ArrayBuilder.AppendDateTime
  - ArrayBuilder.AppendDecimal128
  - ArrayBuilder.AppendDocument
  - ArrayBuilder.AppendDouble
  - ArrayBuilder.AppendInt32
  - ArrayBuilder.AppendInt64
  - ArrayBuilder.AppendJavaScript
  - ArrayBuilder.AppendMaxKey
  - ArrayBuilder.AppendMinKey
  - ArrayBuilder.AppendNull
  - ArrayBuilder.AppendObjectID
  - ArrayBuilder.AppendRegex
  - ArrayBuilder.AppendString
  - ArrayBuilder.AppendSymbol
  - ArrayBuilder.AppendTimestamp
  - ArrayBuilder.AppendUndefined
  - ArrayBuilder.AppendValue
  - ArrayBuilder.StartArray
  - BuildArray
  - BuildArrayElement
  - BuildDocumentElement
  - DocumentBuilder.AppendArray
  - DocumentBuilder.AppendBinary
  - DocumentBuilder.AppendBoolean
  - DocumentBuilder.AppendCodeWithScope
  - DocumentBuilder.AppendDBPointer
  - DocumentBuilder.AppendDateTime
  - DocumentBuilder.AppendDecimal128
  - DocumentBuilder.AppendDocument
  - DocumentBuilder.AppendDouble
  - DocumentBuilder.AppendInt32
  - DocumentBuilder.AppendInt64
  - DocumentBuilder.AppendJavaScript
  - DocumentBuilder.AppendMaxKey
  - DocumentBuilder.AppendMinKey
  - DocumentBuilder.AppendNull
  - DocumentBuilder.AppendObjectID
  - DocumentBuilder.AppendRegex
  - DocumentBuilder.AppendString
  - DocumentBuilder.AppendSymbol
  - DocumentBuilder.AppendTimestamp
  - DocumentBuilder.AppendUndefined
  - DocumentBuilder.AppendValue
  - DocumentBuilder.StartDocument
links:
    pr: https://github.com/mongodb/mongo-go-driver/pull/622
    commit: https://github.com/mongodb/mongo-go-driver/commit/2aca31d5986a9e1c65a92264736de9fdc3b9b4ca
    context:
      - https://github.com/advisories/GHSA-f6mq-5m25-4r72
      - https://jira.mongodb.org/browse/GODRIVER-1923