{"id":"CVE-2013-2132","aliases":["DEBIAN-CVE-2013-2132","DSA-2705-1","EUVD-2013-0028","GHSA-x33v-f3gp-gw2c","MGASA-2013-0201","PYSEC-2013-30","RHSA-2013:1170","openSUSE-SU-2024:10226-1","openSUSE-SU-2024:11256-1","openSUSE-SU-2024:13931-1","openSUSE-SU-2026:11478-1"],"status":"published","title":"Use of NullPointerException Catch to Detect NULL Pointer Dereference in Pymongo","description":"bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an \"invalid DBRef.\"","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04108,"percentile":0.90838,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-395"],"published":"2013-06-10T00:00:00Z","modified":"2026-09-01T20:03:16Z","fixes":[{"ecosystem":"PyPI","package":"pymongo","fixed_in":["2.5.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pymongo","fixed_in":["2.5.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pymongo","fixed_in":["2.5.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pymongo","fixed_in":["2.5.2-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"pymongo","fixed_in":["2.2-4+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"python-pymongo","fixed_in":["2.5-1.1.mga3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-4+deb7u1"}]}],"versions":["2.2-4"]},{"source":"osv","ecosystem":"PyPI","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2"}]}],"versions":["0.1.1pre","0.1.2pre","0.10","0.10.1","0.10.2","0.10.3","0.11","0.11.1","0.11.2","0.11.3","0.12","0.13","0.14","0.14.1","0.14.2","0.15","0.15.1","0.15.2","0.16","0.1pre","0.2pre","0.3.1pre","0.3pre","0.4pre","0.5.1pre","0.5.2pre","0.5.3pre","0.5pre","0.6","0.7","0.7.1","0.7.2","0.8","0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","1.0","1.1","1.1.1","1.1.2","1.10","1.10.1","1.11","1.2","1.2.1","1.3","1.4","1.5","1.5.1","1.5.2","1.6","1.7","1.8","1.8.1","1.9","2.0","2.0.1","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","2.4.2","2.5","2.5.1"]},{"source":"osv","ecosystem":"Mageia:3","package":"python-pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5-1.1.mga3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pymongo","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"a060c15ef87e0f0e72974c7c0e57fe811bbd06a2"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2"}]}],"versions":["0.1.1pre","0.1.2pre","0.10","0.10.1","0.10.2","0.10.3","0.11","0.11.1","0.11.2","0.11.3","0.12","0.13","0.14","0.14.1","0.14.2","0.15","0.15.1","0.15.2","0.16","0.1pre","0.2pre","0.3.1pre","0.3pre","0.4pre","0.5.1pre","0.5.2pre","0.5.3pre","0.5pre","0.6","0.7","0.7.1","0.7.2","0.8","0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","1.0","1.1","1.1.1","1.1.2","1.10","1.10.1","1.11","1.2","1.2.1","1.3","1.4","1.5","1.5.1","1.5.2","1.6","1.7","1.8","1.8.1","1.9","2.0","2.0.1","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","2.4.2","2.5","2.5.1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"mongodb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"mongodb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-11.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"pymongo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-11.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"python-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-11.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"mongodb","product":"mongodb"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2013-06/msg00180.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://ubuntu.com/usn/usn-1897-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.osvdb.org/93804","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"https://jira.mongodb.org/browse/PYTHON-532","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/mongodb/mongo-python-driver/commit/a060c15ef87e0f0e72974c7c0e57fe811bbd06a2","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","evidence","fix","web"]},{"url":"http://seclists.org/oss-sec/2013/q2/447","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=710597","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.debian.org/security/2013/dsa-2705","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/60252","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2132","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pymongo/PYSEC-2013-30.yaml","tags":["web"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=710597","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2013-06/msg00180.html","tags":["web"]},{"url":"https://seclists.org/oss-sec/2013/q2/447","tags":["web"]},{"url":"https://ubuntu.com/usn/usn-1897-1","tags":["web"]},{"url":"https://www.debian.org/security/2013/dsa-2705","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x33v-f3gp-gw2c","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2132","tags":["advisory"]},{"url":"https://github.com/mongodb/mongo-python-driver","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2013-0201.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10496","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1170","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=927536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=969560","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1170.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1892","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1892","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2132","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2132","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21506","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2132","description":"bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an \"invalid DBRef.\"","status":"published","published":"2013-08-15T17:00:00Z","modified":"2024-08-06T15:27:40.62Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-0028","description":"bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an \"invalid DBRef.\"","status":"published","published":"2013-08-15T17:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-x33v-f3gp-gw2c","title":"Use of NullPointerException Catch to Detect NULL Pointer Dereference in Pymongo","description":"bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an \"invalid DBRef.\"","status":"published","published":"2022-05-14T02:10:10Z","modified":"2024-10-15T16:20:41Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-395"],"updated_at":"2026-11-02T14:38:10.696798Z"}],"nvd":[{"id":"CVE-2013-2132","description":"bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an \"invalid DBRef.\"","status":"published","published":"2013-08-15T17:55:24.5Z","modified":"2026-06-16T23:52:48.373Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"GHSA-x33v-f3gp-gw2c","title":"Use of NullPointerException Catch to Detect NULL Pointer Dereference in Pymongo","description":"bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an \"invalid DBRef.\"","status":"published","published":"2022-05-14T02:10:10Z","modified":"2024-10-15T16:26:45.268138Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-395"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"CVE-2013-2132","description":"bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an \"invalid DBRef.\"","status":"published","published":"2013-08-15T17:55:24Z","modified":"2026-08-10T08:27:18.577860464Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2132","description":"bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an \"invalid DBRef.\"","status":"published","published":"2013-08-15T17:55:24.5Z","modified":"2026-09-01T20:03:16.132877812Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2705-1","title":"pymongo - denial of service","status":"published","published":"2013-06-10T00:00:00Z","modified":"2026-03-09T01:19:41.600139Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0201","title":"Updated python-pymongo packages fix CVE-2013-2132","description":"PyMongo before 2.5.2 is prone to a denial-of-service vulnerability. An\nattacker can remotely trigger a NULL pointer dereference causing MongoDB\nto crash (CVE-2013-2132).\n","status":"published","published":"2013-07-06T14:14:28Z","modified":"2026-04-16T06:23:33.27974715Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10226-1","title":"python-pymongo-3.1.1-1.5 on GA media","description":"These are all security issues fixed in the python-pymongo-3.1.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:51.994435Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:11256-1","title":"python36-pymongo-3.11.4-1.2 on GA media","description":"These are all security issues fixed in the python36-pymongo-3.11.4-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:56:21.486588Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13931-1","title":"python310-pymongo-4.6.3-1.1 on GA media","description":"These are all security issues fixed in the python310-pymongo-4.6.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:02.805211Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11478-1","title":"python313-pymongo-4.17.0-1.1 on GA media","description":"These are all security issues fixed in the python313-pymongo-4.17.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-09T00:00:00Z","modified":"2026-08-10T08:15:09.380372683Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"PYSEC-2013-30","description":"bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an \"invalid DBRef.\"","status":"published","published":"2013-08-15T17:55:00Z","modified":"2023-11-08T03:57:17.791634Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2013:1170","title":"Red Hat Security Advisory: mongodb and pymongo security and enhancement update","status":"published","published":"2024-09-13T07:37:10Z","modified":"2026-01-29T10:55:25.709398Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}