CVE-2013-2132
Use of NullPointerException Catch to Detect NULL Pointer Dereference in Pymongo
CVE-2013-2132 is a medium vulnerability (CVSS 4.3) in Mongodb, published June 10, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.11%, the 90th percentile. Fixed in pymongo 2.5.2.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 4.11%EPSS, 90th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.5.2pymongo +13 more
Description
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pymongoPyPI | before 2.5.2 | 2.5.2 |
pymongoDebian:12 | before 2.5.2-1 | 2.5.2-1 |
pymongoDebian:13 | before 2.5.2-1 | 2.5.2-1 |
pymongoDebian:14 | before 2.5.2-1 | 2.5.2-1 |
pymongoDebian:7 | before 2.2-4+deb7u1, plus listed versions 2.2-4 | 2.2-4+deb7u1 |
pymongoPyPI | before 2.5.2, plus listed versions 0.1.1pre0.1.2pre0.100.10.10.10.2 Show 45 moreShow less0.10.30.110.11.10.11.20.11.30.120.130.140.14.10.14.20.150.15.10.15.20.160.1pre0.2pre0.3.1pre0.3pre0.4pre0.5.1pre0.5.2pre0.5.3pre0.5pre0.60.70.7.10.7.20.80.8.10.90.9.10.9.20.9.30.9.40.9.50.9.60.9.71.01.11.1.11.1.21.101.10.11.111.2 | 2.5.2 |
python-pymongoMageia:3 | before 2.5-1.1.mga3 | 2.5-1.1.mga3 |
mongodbRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.6.4-6.el6 | 0:1.6.4-6.el6 |
mongodb-debuginfoRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.6.4-6.el6 | 0:1.6.4-6.el6 |
mongodb-serverRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.6.4-6.el6 | 0:1.6.4-6.el6 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pymongoRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.9-11.el6 | 0:1.9-11.el6 |
pymongo-debuginfoRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.9-11.el6 | 0:1.9-11.el6 |
python-bsonRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.9-11.el6 | 0:1.9-11.el6 |
python-pymongoopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 4.17.0-1.1 | 4.17.0-1.1 |
What each source reports
NVD Score used
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
- Record
CVE-2013-2132- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE ListNo score
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
- Record
CVE-2013-2132- Updated
- 2026-11-02
EUVDEUVD-2013-0028No score
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
- Record
EUVD-2013-0028- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x33v-f3gp-gw2c
Use of NullPointerException Catch to Detect NULL Pointer Dereference in Pymongo
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
- Record
GHSA-x33v-f3gp-gw2c- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-395
- Updated
- 2026-11-02
OSVGHSA-x33v-f3gp-gw2c
Use of NullPointerException Catch to Detect NULL Pointer Dereference in Pymongo
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
- Record
GHSA-x33v-f3gp-gw2c- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-395
- Updated
- 2026-11-02
OSVNo score
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
- Record
CVE-2013-2132- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2013-2132No score
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
- Record
DEBIAN-CVE-2013-2132- Updated
- 2026-11-02
OSVMGASA-2013-0201No score
Updated python-pymongo packages fix CVE-2013-2132
PyMongo before 2.5.2 is prone to a denial-of-service vulnerability. An attacker can remotely trigger a NULL pointer dereference causing MongoDB to crash (CVE-2013-2132).
- Record
MGASA-2013-0201- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10226-1No score
python-pymongo-3.1.1-1.5 on GA media
These are all security issues fixed in the python-pymongo-3.1.1-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10226-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11256-1No score
python36-pymongo-3.11.4-1.2 on GA media
These are all security issues fixed in the python36-pymongo-3.11.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11256-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13931-1No score
python310-pymongo-4.6.3-1.1 on GA media
These are all security issues fixed in the python310-pymongo-4.6.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13931-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11478-1No score
python313-pymongo-4.17.0-1.1 on GA media
These are all security issues fixed in the python313-pymongo-4.17.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11478-1- Updated
- 2026-11-02
OSVPYSEC-2013-30No score
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
- Record
PYSEC-2013-30- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-updates/2013-06/msg00180.html
ubuntu.com/usn/usn-1897-1
osvdb.org/93804
jira.mongodb.org/browse/PYTHON-532
github.com/mongodb/mongo-python-driver/commit/a060c15ef87e0f0e72974c7c0e57fe811bbd06a2
seclists.org/oss-sec/2013/q2/447
Show 22 moreShow less
bugs.debian.org/cgi-bin/bugreport.cgi?bug=710597
debian.org/security/2013/dsa-2705
securityfocus.com/bid/60252
nvd.nist.gov/vuln/detail/CVE-2013-2132
security-tracker.debian.org/tracker/CVE-2013-2132
advisories.mageia.org/MGASA-2013-0201.html
bugs.mageia.org/show_bug.cgi?id=10496
access.redhat.com/errata/RHSA-2013:1170
bugzilla.redhat.com/show_bug.cgi?id=927536
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1170.json
cve.org/CVERecord?id=CVE-2013-1892
suse.com/security/cve/CVE-2013-2132
Left out here: 23 versions. The JSON record has them.