Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-ty2n-gcpe-nye2

Summary

LiteDB may deserialize bad JSON on object type using _type
LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a special field in JSON documents to cast different types from `BsonDocument` to POCO classes. When instances of an object are not the same of class, `BsonMapper` use a special field `_type` string info with full class name with assembly to be loaded and fit into your model. If your end-user can send to your app a plain JSON string, deserialization can load an unsafe object to fit into your model. This issue is patched in version 5.0.13 with some basic fixes to avoid this, but is not 100% guaranteed when using `Object` type. The next major version will contain an allow-list to select what kind of Assembly can be loaded. Workarounds are detailed in the vendor advisory.

Aliases

alias	CVE-2022-23535

alias	GHSA-3x49-g6rc-c284

Fixed_packages

url	pkg:nuget/LiteDB@5.0.13
purl	pkg:nuget/LiteDB@5.0.13
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:nuget/LiteDB@5.0.13

Affected_packages

References

reference_url	https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f
reference_id
reference_type
scores
url	https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f

reference_url	https://github.com/mbdavid/LiteDB/commit/d72c6774e6a13de2cfcd7d477d3575efeb75c8f2
reference_id
reference_type
scores
url	https://github.com/mbdavid/LiteDB/commit/d72c6774e6a13de2cfcd7d477d3575efeb75c8f2

reference_url	https://github.com/mbdavid/LiteDB/releases/tag/v5.0.13
reference_id
reference_type
scores
url	https://github.com/mbdavid/LiteDB/releases/tag/v5.0.13

reference_url	https://github.com/advisories/GHSA-3x49-g6rc-c284
reference_id	GHSA-3x49-g6rc-c284
reference_type
scores
url	https://github.com/advisories/GHSA-3x49-g6rc-c284

reference_url	https://github.com/mbdavid/LiteDB/security/advisories/GHSA-3x49-g6rc-c284
reference_id	GHSA-3x49-g6rc-c284
reference_type
scores
url	https://github.com/mbdavid/LiteDB/security/advisories/GHSA-3x49-g6rc-c284

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	502
name	Deserialization of Untrusted Data
description	The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ty2n-gcpe-nye2

Vulnerability Instance