Publish GHSA-p9rv-qgqw-jx2w

advisories/github-reviewed/2022/05/GHSA-p9rv-qgqw-jx2w/GHSA-p9rv-qgqw-jx2w.json

@@ -1,23 +1,46 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-p9rv-qgqw-jx2w",
-  "modified": "2022-05-24T19:02:24Z",
+  "modified": "2023-12-20T20:26:56Z",
   "published": "2022-05-24T19:02:24Z",
   "aliases": [
     "CVE-2021-20331"
   ],
+  "summary": "MongoDB C# Driver Risk of Exposing Authentication Data via Command Listener",
   "details": "Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as \"saslStart\", \"saslContinue\", \"isMaster\", \"createUser\", and \"updateUser\" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver 2.12 <= 2.12.1.",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "NuGet",
+        "name": "mongodb.driver"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.11.0"
+            },
+            {
+              "fixed": "2.12.2"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20331"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mongodb/mongo-csharp-driver/commit/1f1a526e93ed7aa254759704b19f5ee66a3af365"
+    },
     {
       "type": "WEB",
       "url": "https://jira.mongodb.org/browse/CSHARP-3521"
@@ -28,8 +51,8 @@
       "CWE-200"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-12-20T20:26:56Z",
     "nvd_published_at": "2021-05-13T08:15:00Z"
   }
 }