CVE-2021-20329: Specific cstrings input may not be properly validated in the Go Driver

MongoDB Go Driver could allow a remote authenticated attacker to bypass security restrictions, caused by improper input validation of cstrings when marshalling Go objects into BSON. By sending a specially-crafted Go object with specific string, an attacker could exploit this vulnerability to inject additional fields into marshalled documents.

— IBM

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.

— MITRE

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.