Deserialization allow-list bypass via anonymous-type misdetection in BSON object deserialization

Overview

A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content that an application later deserializes into a loosely typed member can cause types outside the intended allow-list to be constructed and populated with unauthorized party-supplied values inside the consuming application. This can lead to unexpected object state and errors in downstream application logic. No elevated privileges beyond the ability to place unauthorized party-influenced content in the deserialization path are required.

Affected

• c_driver >= 2.21.0 < 3.14.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.