Skip to content

fix: Remote code execution via MongoDB BSON parser through prototype pollution #8675

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Jun 28, 2023
Merged

fix: Remote code execution via MongoDB BSON parser through prototype pollution #8675

merged 2 commits into from
Jun 28, 2023

Conversation

@mtrezza
Copy link
Member

@mtrezza mtrezza commented Jun 28, 2023 •
edited
Loading

Fixes security vulnerability GHSA-462x-c3jw-7vr6

@parse-github-assistant
Copy link

parse-github-assistant bot commented Jun 28, 2023

I will reformat the title to use the proper commit message syntax.

@parse-github-assistant parse-github-assistant bot changed the title fix: release 5.x.x 7vr6 fix: Release 5.x.x 7vr6 Jun 28, 2023
@parse-github-assistant
Copy link

parse-github-assistant bot commented Jun 28, 2023 •
edited
Loading

Thanks for opening this pull request!

  • ❌ Please link an issue that describes the reason for this pull request, otherwise your pull request will be closed. Make sure to write it as Closes: #123 in the PR description, so I can recognize it.

@codecov
Copy link

codecov bot commented Jun 28, 2023 •
edited
Loading

Codecov Report

Patch coverage: 100.00% and project coverage change: -0.01 ⚠️

Comparison is base (a036071) 94.12% compared to head (5e0b494) 94.11%.

❗ Current head 5e0b494 differs from pull request most recent head aeef806. Consider uploading reports for the commit aeef806 to get more accurate results

Additional details and impacted files 
@@                Coverage Diff                @@
##           release-5.x.x    #8675      +/-   ##
=================================================
- Coverage          94.12%   94.11%   -0.01%     
=================================================
  Files                183      183              
  Lines              13798    13803       +5     
=================================================
+ Hits               12987    12991       +4     
- Misses               811      812       +1
Impacted Files Coverage Δ
src/Controllers/DatabaseController.js 93.96% <100.00%> (+0.05%) ⬆️
src/RestWrite.js 94.46% <100.00%> (-0.19%) ⬇️
src/Routers/FilesRouter.js 93.25% <100.00%> (-0.05%) ⬇️
src/Utils.js 98.13% <100.00%> (+0.09%) ⬆️

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

@mtrezza mtrezza merged commit 5fad292 into release-5.x.x Jun 28, 2023
@mtrezza mtrezza deleted the fix-release-5.x.x-7vr6 branch June 28, 2023 20:59
@mtrezza mtrezza changed the title fix: Release 5.x.x 7vr6 fix: Remote code execution via MongoDB BSON parser through prototype pollution Jun 28, 2023
parseplatformorg pushed a commit that referenced this pull request Jun 28, 2023
@semantic-release-bot
chore(release): 5.5.2 [skip ci]
e6374e7 
## [5.5.2](5.5.1...5.5.2) (2023-06-28)

### Bug Fixes

* Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-462x-c3jw-7vr6](GHSA-462x-c3jw-7vr6) ([#8675](#8675)) ([5fad292](5fad292))
@parseplatformorg
Copy link
Contributor

parseplatformorg commented Jun 28, 2023

🎉 This change has been released in version 5.5.2

@parseplatformorg parseplatformorg added the state:released-5.x.x Released as LTS version label Jun 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

state:released-5.x.x Released as LTS version

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mtrezza @parseplatformorg @dblythy