Skip to content
OpenAdvisories
Unscored RHSA-2013:1170 2 CVEs

Red Hat Security Advisory: mongodb and pymongo security and enhancement update

Published Sep 13, 2024 · Updated Jan 29, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · MRG 2 enterprise_mrg:2:server:el6 mongodb 0:1.6.4-6.el6
Red Hat · MRG 2 enterprise_mrg:2:server:el6 mongodb-debuginfo 0:1.6.4-6.el6
Red Hat · MRG 2 enterprise_mrg:2:server:el6 mongodb-server 0:1.6.4-6.el6
Red Hat · MRG 2 enterprise_mrg:2:server:el6 pymongo 0:1.9-11.el6
Red Hat · MRG 2 enterprise_mrg:2:server:el6 pymongo-debuginfo 0:1.9-11.el6
Red Hat · MRG 2 enterprise_mrg:2:server:el6 python-bson 0:1.9-11.el6

Vulnerabilities 2

  • Unscored —
    CVE-2013-1892 Public exploit EPSS 45%

    MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderM…

  • Medium —
    CVE-2013-2132

    Use of NullPointerException Catch to Detect NULL Pointer Dereference in Pymongo

    bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."

    pymongo pymongo Debian PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=927536
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=969560
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1170.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-1892
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-1892
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-1892
  • report
    https://access.redhat.com/security/cve/CVE-2013-2132
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-2132
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-2132