Package: release.debian.org Severity: normal Tags: trixie User: [email protected] Usertags: pu
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 [ Reason ] Address the following issue: * Fix CVE-2026-81524: validate db and collection names [ Impact ] Without this fix, users and applications integrating libmongocrypt components may be vulnerable to potential information modification or disclosure. [ Tests ] The affected/changed code went through upstream code reviews. Also, accompanying unit tests were implemented and executed in upstream's extensive CI environment. [ Risks ] Code changes are minimal (to the extent possible), extensively reviewed/tested, and low risk. There are no work arounds. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Backport the following upstream change: https://github.com/mongodb/mongo-c-driver/commit/81d0f794d07224c53f815ceb59daed28103dcf3d [ Other info ] N/A -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEIYZ1DR4ae5UL01q7ldFmTdL1kUIFAmqTA6MACgkQldFmTdL1 kUL9OA/9H4GmIrMIkngE2ZATKuHBXhlCv+5SnWQy2HB4zi+rFHn3sEg0eNfXTR7w qKRxWfD/XJsMU1owt9wtVj79bP+m/AAaNMgbjrqm0HT6eGG6npJwiCISH1WsBysb U1EDRu2IgS06SaVsk2+MWONdP6K5jhQgv1s/VgPSrRjdN9y2rP2l+B1GKV+7w34f c0Q+Q+YNfn+B0N89Xq0UN3ALse+EigXIyv6Li9nb9KjOk4FQKuEVzMMDW6ar6xeI CsGTTGvGMsrBYCliEDOF3dNFhgKosv8JNgGs2Vbtq2IgItNQZHOeIw+z7mRM0ew1 JzSsf8LrCboM9zF9gaFsufkDcEWRGsaeHb2nG/cWzo5HQEZ4epYrReu1I3yrOPpX rKtAz6aW9E4PFdJ1j4YME9Se5vLzRtyzFEe9Pg0xGznTx1l30OsbV0pintbwJwm8 DQKb2479hcAHhczoZhAdm1cO8JH5cDJxOySxaD5LPbtGiGIY2oia2CTzt7mqQklc E322eFR8V7iMUsi11srb3HTyYWn/3vq72BJJBONZ5NBXFLQp1HgjcgNgQH8O7hSZ jBTxt3UVmA6affa6j4MY/J5aBfbleDD/eixW7hBhlVBMI91b46mgFM76+XaMFqyR zTla4LhLwYqigsWbqO2X4rEuBpiM1Q/ItytI7ikRPqBcP6yNqOo= =cqRe -----END PGP SIGNATURE-----
diff -Nru mongo-c-driver-1.30.4/debian/changelog mongo-c-driver-1.30.4/debian/changelog --- mongo-c-driver-1.30.4/debian/changelog 2026-04-27 11:48:27.000000000 -0400 +++ mongo-c-driver-1.30.4/debian/changelog 2026-08-29 11:06:27.000000000 -0400 @@ -1,3 +1,9 @@ +mongo-c-driver (1.30.4-1+deb13u3) trixie; urgency=medium + + * Fix CVE-2026-81524: validate db and collection names + + -- Roberto C. Sanchez <[email protected]> Sat, 29 Aug 2026 11:06:27 -0400 + mongo-c-driver (1.30.4-1+deb13u2) trixie; urgency=medium * Fix CVE-2026-6231: bson_validate may skip validation when processing diff -Nru mongo-c-driver-1.30.4/debian/patches/0009_CVE-2026-81524.patch mongo-c-driver-1.30.4/debian/patches/0009_CVE-2026-81524.patch --- mongo-c-driver-1.30.4/debian/patches/0009_CVE-2026-81524.patch 1969-12-31 19:00:00.000000000 -0500 +++ mongo-c-driver-1.30.4/debian/patches/0009_CVE-2026-81524.patch 2026-08-29 11:06:27.000000000 -0400 @@ -0,0 +1,443 @@ +From 81d0f794d07224c53f815ceb59daed28103dcf3d Mon Sep 17 00:00:00 2001 +From: Kevin Albertson <[email protected]> +Date: Fri, 14 Aug 2026 12:39:43 -0400 +Subject: [PATCH] CDRIVER-6424 validate db and collection names + +--- + src/libmongoc/src/mongoc/mongoc-aggregate-private.h | 1 + src/libmongoc/src/mongoc/mongoc-aggregate.c | 8 + + src/libmongoc/src/mongoc/mongoc-client-side-encryption.c | 12 ++ + src/libmongoc/src/mongoc/mongoc-client.c | 4 + src/libmongoc/src/mongoc/mongoc-cmd.c | 7 + + src/libmongoc/src/mongoc/mongoc-collection.c | 13 ++ + src/libmongoc/src/mongoc/mongoc-cursor-private.h | 4 + src/libmongoc/src/mongoc/mongoc-cursor.c | 15 ++ + src/libmongoc/src/mongoc/mongoc-database.c | 2 + src/libmongoc/src/mongoc/mongoc-gridfs-bucket.c | 16 +++ + src/libmongoc/src/mongoc/mongoc-uri.c | 20 +++ + src/libmongoc/src/mongoc/mongoc-util-private.h | 34 ++++++ + src/libmongoc/src/mongoc/mongoc-util.c | 76 +++++++++++++++ + 13 files changed, 211 insertions(+), 1 deletion(-) + create mode 100644 src/libmongoc/tests/test-mongoc-ns-validation.c + +--- a/src/libmongoc/src/mongoc/mongoc-aggregate-private.h ++++ b/src/libmongoc/src/mongoc/mongoc-aggregate-private.h +@@ -34,6 +34,7 @@ + mongoc_cursor_t * + _mongoc_aggregate (mongoc_client_t *client, + const char *ns, ++ const char *db, + mongoc_query_flags_t flags, + const bson_t *pipeline, + const bson_t *opts, +--- a/src/libmongoc/src/mongoc/mongoc-aggregate.c ++++ b/src/libmongoc/src/mongoc/mongoc-aggregate.c +@@ -185,6 +185,7 @@ + * information on how to build aggregation pipelines. + * + * Parameters: ++ * @db: Database name used. Separated from @ns to validate. + * @ns: Namespace (or database name for database-level aggregation). + * @flags: Bitwise or of mongoc_query_flags_t or 0. + * @pipeline: A bson_t containing the pipeline request. @pipeline +@@ -210,6 +211,7 @@ + + mongoc_cursor_t * + _mongoc_aggregate (mongoc_client_t *client, ++ const char *db, + const char *ns, + mongoc_query_flags_t flags, + const bson_t *pipeline, +@@ -237,6 +239,7 @@ + + BSON_ASSERT (client); + BSON_ASSERT (ns); ++ BSON_ASSERT_PARAM(db); + BSON_ASSERT (pipeline); + + bson_init (&cursor_opts); +@@ -274,6 +277,11 @@ + GOTO (done); + } + ++ // `ns` is already joined and cannot be split back into `db` reliably. Check `db` while it is still separate. ++ if (!_mongoc_cursor_check_db_name(cursor, db)) { ++ GOTO(done); ++ } ++ + if (!_mongoc_read_prefs_validate (cursor->read_prefs, &cursor->error)) { + GOTO (done); + } +--- a/src/libmongoc/src/mongoc/mongoc-client-side-encryption.c ++++ b/src/libmongoc/src/mongoc/mongoc-client-side-encryption.c +@@ -1787,6 +1787,10 @@ + GOTO (fail); + } + ++ if (!_mongoc_validate_db_name(opts->keyvault_db, -1, error)) { ++ GOTO(fail); ++ } ++ + if (!opts->kms_providers) { + bson_set_error ( + error, MONGOC_ERROR_CLIENT, MONGOC_ERROR_CLIENT_INVALID_ENCRYPTION_ARG, "KMS providers option required"); +@@ -1918,6 +1922,10 @@ + GOTO (fail); + } + ++ if (!_mongoc_validate_db_name(opts->keyvault_db, -1, error)) { ++ GOTO(fail); ++ } ++ + if (!opts->kms_providers) { + bson_set_error ( + error, MONGOC_ERROR_CLIENT, MONGOC_ERROR_CLIENT_INVALID_ENCRYPTION_ARG, "KMS providers option required"); +@@ -2027,6 +2035,10 @@ + goto fail; + } + ++ if (!_mongoc_validate_db_name(opts->keyvault_db, -1, error)) { ++ goto fail; ++ } ++ + if (!opts->kms_providers) { + bson_set_error ( + error, MONGOC_ERROR_CLIENT, MONGOC_ERROR_CLIENT_INVALID_ENCRYPTION_ARG, "KMS providers option required"); +--- a/src/libmongoc/src/mongoc/mongoc-client.c ++++ b/src/libmongoc/src/mongoc/mongoc-client.c +@@ -1407,6 +1407,10 @@ + prefix = "fs"; + } + ++ if (!_mongoc_validate_db_name(db, -1, error)) { ++ return NULL; ++ } ++ + return _mongoc_gridfs_new (client, db, prefix, error); + } + +--- a/src/libmongoc/src/mongoc/mongoc-cmd.c ++++ b/src/libmongoc/src/mongoc/mongoc-cmd.c +@@ -730,6 +730,13 @@ + BSON_ASSERT (!parts->assembled.command); + BSON_ASSERT (bson_empty (&parts->assembled_body)); + ++ // The database name is sent as "$db" for OP_MSG or as "<db>.$cmd" for OP_QUERY. ++ // Reject a name the driver cannot forward faithfully, rather than silently targeting a different database. ++ BSON_ASSERT(parts->assembled.db_name); ++ if (!_mongoc_validate_db_name(parts->assembled.db_name, -1, error)) { ++ GOTO(done); ++ } ++ + /* begin with raw flags/cmd as assembled flags/cmd, might change below */ + parts->assembled.command = parts->body; + /* unused in OP_MSG: */ +--- a/src/libmongoc/src/mongoc/mongoc-collection.c ++++ b/src/libmongoc/src/mongoc/mongoc-collection.c +@@ -288,6 +288,7 @@ + { + return _mongoc_aggregate (collection->client, + collection->ns, ++ collection->db, + flags, + pipeline, + opts, +@@ -440,8 +441,12 @@ + + bson_clear (&collection->gle); + +- return _mongoc_cursor_find_new ( ++ mongoc_cursor_t *const cursor = _mongoc_cursor_find_new( + collection->client, collection->ns, filter, opts, read_prefs, collection->read_prefs, collection->read_concern); ++ ++ _mongoc_cursor_check_db_name(cursor, collection->db); ++ ++ return cursor; + } + + +@@ -1621,6 +1626,7 @@ + /* No read preference. Index Enumeration Spec: "run listIndexes on the + * primary node in replicaSet mode". */ + cursor = _mongoc_cursor_cmd_new (collection->client, collection->ns, &cmd, opts, NULL, NULL, NULL); ++ _mongoc_cursor_check_db_name(cursor, collection->db); + + if (!mongoc_cursor_error (cursor, &error)) { + _mongoc_cursor_prime (cursor); +@@ -2899,6 +2905,11 @@ + return false; + } + ++ // The "to" field below is a joined namespace, which the server splits at the first ".". ++ if (new_db && !_mongoc_validate_db_name(new_db, -1, error)) { ++ return false; ++ } ++ + newns = bson_strdup_printf ("%s.%s", new_db ? new_db : collection->db, new_name); + + BSON_APPEND_UTF8 (&cmd, "renameCollection", collection->ns); +--- a/src/libmongoc/src/mongoc/mongoc-cursor-private.h ++++ b/src/libmongoc/src/mongoc/mongoc-cursor-private.h +@@ -165,6 +165,10 @@ + _mongoc_n_return (mongoc_cursor_t *cursor); + void + _mongoc_set_cursor_ns (mongoc_cursor_t *cursor, const char *ns, uint32_t nslen); ++// Set an error on the cursor if `db` is not a valid database name. ++// Useful since `_mongoc_set_cursor_ns` does not know if a "." is in the db (invalid) or collection (valid). ++bool ++_mongoc_cursor_check_db_name(mongoc_cursor_t *cursor, const char *db); + bool + _mongoc_cursor_get_opt_bool (const mongoc_cursor_t *cursor, const char *option); + void +--- a/src/libmongoc/src/mongoc/mongoc-cursor.c ++++ b/src/libmongoc/src/mongoc/mongoc-cursor.c +@@ -174,6 +174,21 @@ + } + + ++bool ++_mongoc_cursor_check_db_name(mongoc_cursor_t *cursor, const char *db) ++{ ++ BSON_ASSERT_PARAM(cursor); ++ BSON_ASSERT_PARAM(db); ++ ++ // Preserve an error already recorded by cursor construction. ++ if (CURSOR_FAILED(cursor)) { ++ return false; ++ } ++ ++ return _mongoc_validate_db_name(db, -1, &cursor->error); ++} ++ ++ + /* return first key beginning with $, or NULL. precondition: bson is valid. */ + static const char * + _first_dollar_field (const bson_t *bson) +--- a/src/libmongoc/src/mongoc/mongoc-database.c ++++ b/src/libmongoc/src/mongoc/mongoc-database.c +@@ -137,6 +137,7 @@ + { + return _mongoc_aggregate (db->client, + db->name, ++ db->name, + MONGOC_QUERY_NONE, + pipeline, + opts, +@@ -755,6 +756,7 @@ + /* Enumerate Collections Spec: "run listCollections on the primary node in + * replicaset mode" */ + cursor = _mongoc_cursor_cmd_new (database->client, database->name, &cmd, opts, NULL, NULL, NULL); ++ _mongoc_cursor_check_db_name(cursor, database->name); + if (cursor->error.domain == 0) { + _mongoc_cursor_prime (cursor); + } +--- a/src/libmongoc/src/mongoc/mongoc-gridfs-bucket.c ++++ b/src/libmongoc/src/mongoc/mongoc-gridfs-bucket.c +@@ -25,6 +25,7 @@ + #include <mongoc/mongoc-stream-gridfs-download-private.h> + #include <mongoc/mongoc-stream-gridfs-upload-private.h> + #include <mongoc/mongoc-stream-private.h> ++#include <mongoc/mongoc-util-private.h> + #include <mongoc/mongoc-write-concern-private.h> + + /*-------------------------------------------------------------------------- +@@ -94,6 +95,21 @@ + return NULL; + } + ++ // Validate `bucketName` from the BSON options since it may contain an embedded NUL. ++ { ++ bson_iter_t iter; ++ ++ if (opts && bson_iter_init_find(&iter, opts, "bucketName") && BSON_ITER_HOLDS_UTF8(&iter)) { ++ uint32_t bucket_name_len; ++ const char *const bucket_name = bson_iter_utf8(&iter, &bucket_name_len); ++ ++ if (!_mongoc_validate_collection_name(bucket_name, bucket_name_len, error)) { ++ _mongoc_gridfs_bucket_opts_cleanup(&gridfs_opts); ++ return NULL; ++ } ++ } ++ } ++ + /* Initialize the bucket fields */ + if (strlen (gridfs_opts.bucketName) + strlen (".chunks") + 1 > sizeof (buf)) { + bson_set_error (error, +--- a/src/libmongoc/src/mongoc/mongoc-uri.c ++++ b/src/libmongoc/src/mongoc/mongoc-uri.c +@@ -1296,6 +1296,15 @@ + source = bson_iter_utf8 (&iter, NULL); + } + ++ // Validate `authSource`: ++ { ++ bson_error_t validate_error; ++ if (source && !_mongoc_validate_db_name(source, -1, &validate_error)) { ++ MONGOC_URI_ERROR(error, "%s", validate_error.message); ++ return false; ++ } ++ } ++ + if (mongoc_uri_get_auth_mechanism (uri)) { + /* authSource with GSSAPI or X509 should always be external */ + if (!strcasecmp (mongoc_uri_get_auth_mechanism (uri), "GSSAPI") || +@@ -1937,6 +1946,12 @@ + return false; + } + ++ // Match the validation applied to a database name parsed from the URI path. `_parse_path` rejects a larger set of ++ // characters; a "." is rejected here because it would silently retarget the namespace. ++ if (!_mongoc_validate_db_name_or_log(database)) { ++ return false; ++ } ++ + if (uri->database) { + bson_free (uri->database); + } +@@ -1992,6 +2007,11 @@ + return false; + } + ++ // `authSource` is a database name. See `mongoc_uri_finalize_auth`. ++ if (!_mongoc_validate_db_name_or_log(value)) { ++ return false; ++ } ++ + mongoc_uri_bson_append_or_replace_key (&uri->credentials, MONGOC_URI_AUTHSOURCE, value); + + return true; +--- a/src/libmongoc/src/mongoc/mongoc-util-private.h ++++ b/src/libmongoc/src/mongoc/mongoc-util-private.h +@@ -98,6 +98,40 @@ + bool + _mongoc_validate_replace (const bson_t *insert, bson_validate_flags_t vflags, bson_error_t *error); + ++/** ++ * @brief Validate a database name argument. ++ * ++ * Rejects a "." (the driver joins `db + "." + collection` into a namespace that the server splits at the first ".", ++ * so the server would never see the intended database name) and an embedded NUL byte (the name is truncated by the ++ * C string and wire protocol cstring encodings). Other characters prohibited by the MongoDB manual are forwarded ++ * faithfully and are left for the server to reject. ++ * ++ * @param db The database name to validate. ++ * @param db_len The length of @p db in bytes, or a negative value if @p db is NUL-terminated. ++ * @param error Optional out-parameter for the error. ++ * @return true if @p db is a usable database name. ++ */ ++bool ++_mongoc_validate_db_name(const char *db, int64_t db_len, bson_error_t *error); ++ ++/** ++ * @brief Validate a collection name argument. ++ * ++ * Rejects an embedded NUL byte. A "." is permitted in a collection name. ++ * ++ * @param collection The collection name to validate. ++ * @param collection_len The length of @p collection in bytes, or a negative value if @p collection is NUL-terminated. ++ * @param error Optional out-parameter for the error. ++ * @return true if @p collection is a usable collection name. ++ */ ++bool ++_mongoc_validate_collection_name(const char *collection, int64_t collection_len, bson_error_t *error); ++ ++// _mongoc_validate_db_name_or_log validates a NUL-terminated database name, logging the error at the ERROR level if ++// invalid. For use by APIs that have no `bson_error_t` out-parameter. ++bool ++_mongoc_validate_db_name_or_log(const char *db); ++ + bool + _mongoc_validate_update (const bson_t *update, bson_validate_flags_t vflags, bson_error_t *error); + +--- a/src/libmongoc/src/mongoc/mongoc-util.c ++++ b/src/libmongoc/src/mongoc/mongoc-util.c +@@ -18,6 +18,7 @@ + #define _CRT_RAND_S + #endif + ++#include <limits.h> + #include <string.h> + + #include <bson/bson.h> +@@ -464,6 +465,81 @@ + } + + return true; ++} ++ ++ ++// _validate_name checks a database or collection name argument for characters the driver's own encoding cannot ++// faithfully forward to the server. See `_mongoc_validate_db_name` and `_mongoc_validate_collection_name`. ++static bool ++_validate_name(const char *name, int64_t name_len, bool is_db, bson_error_t *error) ++{ ++ BSON_ASSERT_PARAM(name); ++ BSON_OPTIONAL_PARAM(error); ++ ++ size_t len = 0; ++ if (name_len < 0) { ++ len = strlen(name); ++ } else if (mcommon_in_range_signed(size_t, name_len)) { ++ len = (size_t)name_len; ++ } else { ++ bson_set_error(error, ++ MONGOC_ERROR_NAMESPACE, ++ MONGOC_ERROR_NAMESPACE_INVALID, ++ "%s name invalid: too large", ++ is_db ? "database" : "collection"); ++ return false; ++ } ++ ++ if (memchr(name, '\0', len)) { ++ bson_set_error(error, ++ MONGOC_ERROR_NAMESPACE, ++ MONGOC_ERROR_NAMESPACE_INVALID, ++ "%s name invalid: contains a NUL byte", ++ is_db ? "database" : "collection"); ++ return false; ++ } ++ ++ if (is_db && memchr(name, '.', len)) { ++ const int print_len = mcommon_in_range_signed(int, len) ? (int)len : INT_MAX; ++ ++ bson_set_error(error, ++ MONGOC_ERROR_NAMESPACE, ++ MONGOC_ERROR_NAMESPACE_INVALID, ++ "database name \"%.*s\" invalid: contains \".\"", ++ print_len, ++ name); ++ return false; ++ } ++ ++ return true; ++} ++ ++ ++bool ++_mongoc_validate_db_name(const char *db, int64_t db_len, bson_error_t *error) ++{ ++ return _validate_name(db, db_len, true /* is_db */, error); ++} ++ ++ ++bool ++_mongoc_validate_collection_name(const char *collection, int64_t collection_len, bson_error_t *error) ++{ ++ return _validate_name(collection, collection_len, false /* is_db */, error); ++} ++ ++ ++bool ++_mongoc_validate_db_name_or_log(const char *db) ++{ ++ bson_error_t error; ++ ++ if (!_mongoc_validate_db_name(db, -1, &error)) { ++ MONGOC_ERROR("%s", error.message); ++ return false; ++ } ++ ++ return true; + } + + diff -Nru mongo-c-driver-1.30.4/debian/patches/series mongo-c-driver-1.30.4/debian/patches/series --- mongo-c-driver-1.30.4/debian/patches/series 2026-04-27 11:48:27.000000000 -0400 +++ mongo-c-driver-1.30.4/debian/patches/series 2026-08-29 11:06:27.000000000 -0400 @@ -7,3 +7,4 @@ 0006_CVE-2025-14911.patch 0007_CVE-2025-14911.patch 0008_CVE-2026-6691.patch +0009_CVE-2026-81524.patch
