CVE-2024-21506
Updated python-pymongo packages fix security vulnerability
Duplicate of CVE-2024-5629.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
What each source reports
OSV Score usedOESA-2024-1388
python-pymongo security update
The PyMongo distribution contains tools for interacting with \ MongoDB database from Python.\ PyMongo supports MongoDB 2.6, 3.0, 3.2, 3.4, 3.6, 4.0 and 4.2.
Security Fix(es):
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.(CVE-2024-21506)
- Record
OESA-2024-1388- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
CVE List No score
Duplicate of CVE-2024-5629.
- Record
CVE-2024-21506- Updated
- 2026-11-02
EUVDEUVD-2024-19195 No score
Duplicate of CVE-2024-5629.
- Record
EUVD-2024-19195- Updated
- 2026-11-03
NVD No score
Rejected reason: Duplicate of CVE-2024-5629.
- Record
CVE-2024-21506- Updated
- 2026-11-02
OSVMGASA-2024-0187 No score
Updated python-pymongo packages fix security vulnerability
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.
- Record
MGASA-2024-0187- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13931-1 No score
python310-pymongo-4.6.3-1.1 on GA media
These are all security issues fixed in the python310-pymongo-4.6.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13931-1- Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2026:11478-1 No score
python313-pymongo-4.17.0-1.1 on GA media
These are all security issues fixed in the python313-pymongo-4.17.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11478-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1571-1 No score
Security update for python-pymongo
This update for python-pymongo fixes the following issues:
- CVE-2024-21506: Fixed out-of-bounds read in the BSON module (bsc#1222492)
- Record
SUSE-SU-2024:1571-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1571-2 No score
Security update for python-pymongo
This update for python-pymongo fixes the following issues:
- CVE-2024-21506: Fixed out-of-bounds read in the BSON module (bsc#1222492)
- Record
SUSE-SU-2024:1571-2- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-21506 No score
** REJECT ** Duplicate of CVE-2024-5629.
- Record
UBUNTU-CVE-2024-21506- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-pymongoMageia:9 |
before 4.3.3-1.1.mga9 | 4.3.3-1.1.mga9 |
python-pymongoopenEuler:20.03-LTS-SP1 |
before 3.9.0-6.oe1 | 3.9.0-6.oe1 |
python-pymongoopenEuler:20.03-LTS-SP4 |
before 3.9.0-6.oe2003sp4 | 3.9.0-6.oe2003sp4 |
python-pymongoopenEuler:22.03-LTS |
before 3.11.3-3.oe2203sp3 | 3.11.3-3.oe2203sp3 |
python-pymongoopenEuler:22.03-LTS-SP1 |
before 3.11.3-3.oe2203sp1 | 3.11.3-3.oe2203sp1 |
python-pymongoopenEuler:22.03-LTS-SP2 |
before 3.11.3-3.oe2203sp2 | 3.11.3-3.oe2203sp2 |
python-pymongoopenEuler:22.03-LTS-SP3 |
before 3.11.3-3.oe2203sp3 | 3.11.3-3.oe2203sp3 |
python-pymongoSUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 3.11.0-150300.3.3.1 | 3.11.0-150300.3.3.1 |
python-pymongoopenSUSE:Leap 15.5 |
before 3.11.0-150300.3.3.1 | 3.11.0-150300.3.3.1 |
python-pymongoSUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 3.11.0-150300.3.3.1 | 3.11.0-150300.3.3.1 |
python-pymongoopenSUSE:Leap 15.6 |
before 3.11.0-150300.3.3.1 | 3.11.0-150300.3.3.1 |
python-pymongoopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 4.17.0-1.1 | 4.17.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases, products, published | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21506 has been rejected by its source and should not be treated as a live vulnerability, published April 6, 2024. Fixed in python-pymongo 4.3.3-1.1.mga9.
References
advisories.mageia.org/MGASA-2024-0187.html
bugs.mageia.org/show_bug.cgi?id=33202
lwn.net/Articles/973068
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1388
nvd.nist.gov/vuln/detail/CVE-2024-21506
suse.com/support/update/announcement/2024/suse-su-20241571-1
Show 8 moreShow less
bugzilla.suse.com/1222492
ubuntu.com/security/CVE-2024-21506
security.snyk.io/vuln/SNYK-PYTHON-PYMONGO-6370597
gist.github.com/keltecc/62a7c2bf74a997d0a7b48a0ff3853a03
cve.org/CVERecord?id=CVE-2024-21506