Bug 822798 (CVE-2013-2132) - VUL-0: python-pymongo: CVE-2013-2132: User-triggerable NULL pointer dereference due to utter plebbery
Summary: VUL-0: python-pymongo: CVE-2013-2132: User-triggerable NULL pointer dereferen...
Status: VERIFIED FIXED
Alias: CVE-2013-2132
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Max Lin
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-06-03 01:18 UTC by Alexander Bergmann
Modified: 2013-06-24 22:28 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2013-06-03 01:18:57 UTC 
Public via oss-security:

Date: Fri, 31 May 2013 13:10:23 -0600
From: Kurt Seifried
Subject: [oss-security] CVE-2013-2132 MongoDB: User-triggerable NULL pointer dereference due to utter plebbery

https://jira.mongodb.org/browse/PYTHON-532

Short summary:

Step 1. Use Mongo as WEB SCALE DOCUMENT STORE OF CHOICE LOL
Step 2. Assume basic engineering principles applied throughout due to
HEAVY MARKETING SUGGESTING AWESOMENESS.
Step 3. Spend 6 months fighting plebbery across the spectrum, mostly
succeed.
Step 4. NIGHT BEFORE INVESTOR DEMO, TRY UPLOADING SOME DATA WITH
"{$ref: '#/mongodb/plebtastic'"
Step 5. LOL WTF?!?!? PYMONGO CRASH?? :OOO LOOOL WEBSCALE
Step 6. It's 4am now. STILL INVESTIGATING
b4cb9be0 pymongo/_cbsonmodule.c (Mike Dirolf 2009-11-10 14:54:39 -0500
1196) /* Decoding for DBRefs */
Oh Mike!!!


3. ADD process_dbrefs=False TO ALL THE DRIVERS

To reproduce:
? in mongo shell:
db.python532.insert({x : {"$ref" : "whatever"} });
? in python shell
import pymongo
pymongo.MongoClient().test.python532.find_one()

Fix:
https://github.com/mongodb/mongo-python-driver/commit/a060c15ef87e0f0e72974c7c0e57fe811bbd06a2


RedHat reference:
https://bugzilla.redhat.com/show_bug.cgi?id=969560
Comment 1 Swamp Workflow Management 2013-06-03 16:00:49 UTC 
bugbot adjusting priority
Comment 2 Max Lin 2013-06-03 21:43:38 UTC 
SR177316 sent for 12.3
and also I'll update python-pymongo to 2.5.2(inclusive fixes) to d:l:p. Thanks!
Comment 3 Bernhard Wiedemann 2013-06-03 22:00:08 UTC 
This is an autogenerated message for OBS integration:
This bug (822798) was mentioned in
https://build.opensuse.org/request/show/177316 Maintenance /
Comment 4 Jeffrey Cheung 2013-06-04 04:27:17 UTC 
Hi Max,

Please close the issue when you finished updated python-pymongo to 2.5.2 ( inclusive fixes ).

thanks.
Comment 5 Swamp Workflow Management 2013-06-21 05:04:35 UTC 
openSUSE-SU-2013:1064-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 822798
CVE References: CVE-2013-2132
Sources used:
openSUSE 12.3 (src):    python-pymongo-2.4.1-2.4.1, python3-pymongo-2.4.1-2.4.1
Comment 6 Max Lin 2013-06-24 22:28:33 UTC 
seems everything is fine, just set this CLOSED as FIXED for verify.