diff --git a/advisories/unreviewed/2022/05/GHSA-p9rv-qgqw-jx2w/GHSA-p9rv-qgqw-jx2w.json b/advisories/github-reviewed/2022/05/GHSA-p9rv-qgqw-jx2w/GHSA-p9rv-qgqw-jx2w.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-p9rv-qgqw-jx2w/GHSA-p9rv-qgqw-jx2w.json rename to advisories/github-reviewed/2022/05/GHSA-p9rv-qgqw-jx2w/GHSA-p9rv-qgqw-jx2w.json index 99a0277f870..a877cd83ff3 100644 --- a/advisories/unreviewed/2022/05/GHSA-p9rv-qgqw-jx2w/GHSA-p9rv-qgqw-jx2w.json +++ b/advisories/github-reviewed/2022/05/GHSA-p9rv-qgqw-jx2w/GHSA-p9rv-qgqw-jx2w.json @@ -1,23 +1,46 @@ { "schema_version": "1.4.0", "id": "GHSA-p9rv-qgqw-jx2w", - "modified": "2022-05-24T19:02:24Z", + "modified": "2023-12-20T20:26:56Z", "published": "2022-05-24T19:02:24Z", "aliases": [ "CVE-2021-20331" ], + "summary": "MongoDB C# Driver Risk of Exposing Authentication Data via Command Listener", "details": "Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as \"saslStart\", \"saslContinue\", \"isMaster\", \"createUser\", and \"updateUser\" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver 2.12 <= 2.12.1.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "NuGet", + "name": "mongodb.driver" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.11.0" + }, + { + "fixed": "2.12.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20331" }, + { + "type": "WEB", + "url": "https://github.com/mongodb/mongo-csharp-driver/commit/1f1a526e93ed7aa254759704b19f5ee66a3af365" + }, { "type": "WEB", "url": "https://jira.mongodb.org/browse/CSHARP-3521" @@ -28,8 +51,8 @@ "CWE-200" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-12-20T20:26:56Z", "nvd_published_at": "2021-05-13T08:15:00Z" } } \ No newline at end of file