CVE-2015-4411

Published February 20th, 2020

View on NVD ↗

CVSS v3

7.5

HIGH

CVSS v2

MEDIUM

Affected

PROJECTS

Description

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.

mongoid/moped

A MongoDB driver for Ruby

GitHub

197

mongodb/bson-ruby

Ruby Implementation of the BSON Specification (2.0.0+)

GitHub