[Git][security-tracker-team/security-tracker][master] update notes (closing commits) on mongo-c-driver CVEs

[Roberto C. Sánchez (@roberto)]

Roberto C. Sánchez pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5845c995 by Roberto C. Sánchez at 2026-11-04T09:05:08-05:00
update notes (closing commits) on mongo-c-driver CVEs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -693,9 +693,19 @@ CVE-2026-120988 (billboard.js before 4.1.3 allows an attacker to execute malicio
 CVE-2026-120959 (A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause  ...)
 	TODO: check
 CVE-2026-120956 (The MongoDB C Driver does not validate the type or format of a namespa ...)
-	TODO: check
+	- mongo-c-driver 2.5.8-1
+	[trixie] - mongo-c-driver <no-dsa> (Minor issue)
+	NOTE: https://jira.mongodb.org/browse/CDRIVER-6501
+	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/bdab7de9432389b214ba695fa7067c4c413a1900 (2.5.8)
+	NOTE: Additionally depends on CDRIVER-6401 fix: https://github.com/mongodb/mongo-c-driver/commit/8f8274cd301a6e70d5eefccfac1b35ac2ed43c92 (2.5.6)
+	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/4fdc5d553801fcde7bd5c86370917cc4ac704f54 (1.30.15)
+	NOTE: Additionally depends on CDRIVER-6401 fix: https://github.com/mongodb/mongo-c-driver/commit/9e5423f882089c2fbede5cafd5a1fee1bab58780 (1.30.15)
 CVE-2026-120955 (The GridFS file download API in the MongoDB C Driver does not check th ...)
-	TODO: check
+	- mongo-c-driver 2.5.8-1
+	[trixie] - mongo-c-driver <no-dsa> (Minor issue)
+	NOTE: https://jira.mongodb.org/browse/CDRIVER-6494
+	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/25cbf31e919ed0ec81f090b309268e602828d243 (2.5.8)
+	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/811030d131c4caba8dc9645c54319d692ca7b851 (1.30.15)
 CVE-2026-120954 (A weakness in the BSON library's handling of a specialized binary vect ...)
 	TODO: check
 CVE-2026-120953 (A URI redirection weakness exists in the authentication component of t ...)
@@ -747,7 +757,11 @@ CVE-2026-120716 (Insertion of sensitive information into sent data in the identi
 CVE-2026-120715 (Server-side request forgery in the Active Directory credential validat ...)
 	NOT-FOR-US: Devolutions
 CVE-2026-120684 (A memory-initialization flaw in the legacy GridFS file handling of the ...)
-	TODO: check
+	- mongo-c-driver 2.5.8-1
+	[trixie] - mongo-c-driver <no-dsa> (Minor issue)
+	NOTE: https://jira.mongodb.org/browse/CDRIVER-6508
+	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/fe5764b2caaaf368e924b8eef8ee2e5c5700120d (2.5.8)
+	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/edde153ac24b5c68d768f8a3c8dd0a435000466c (1.30.15)
 CVE-2026-120678 (A memory management flaw in the MongoDB C Driver's handling of compres ...)
 	- mongo-c-driver 2.5.8-1
 	NOTE: https://jira.mongodb.org/browse/CDRIVER-6521



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5845c995ddaf8da0879c5112d8f93457211c405a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5845c995ddaf8da0879c5112d8f93457211c405a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/aba2e52c/attachment.htm>