Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4175 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4175-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Roberto C. Snchez     May 20, 2025                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : mongo-c-driver     Version        : 1.17.6-1+deb11u1     CVE ID         : CVE-2021-32050 CVE-2023-0437 CVE-2024-6381 CVE-2024-6383                      CVE-2025-0755

    Multiple vulnerabilities have been discovered in the MongoDB C Driver.

    CVE-2021-32050

        Some MongoDB Drivers may erroneously publish events containing         authentication-related data to a command listener configured by an         application. The published events may contain security-sensitive         data when specific authentication-related commands are executed.
        Without due care, an application may inadvertently expose this         sensitive information, e.g., by writing it to a log file. This issue         only arises if an application enables the command listener feature         (this is not enabled by default).

    CVE-2023-0437

        When calling bson_utf8_validate on some inputs a loop with an exit         condition that cannot be reached may occur, i.e. an infinite loop.

    CVE-2024-6381

        The bson_strfreev function in the MongoDB C driver library may be         susceptible to an integer overflow where the function will try to         free memory at a negative offset. This may result in memory         corruption.

    CVE-2024-6383

        The bson_string_append function in MongoDB C Driver may be         vulnerable to a buffer overflow where the function might attempt to         allocate too small of buffer and may lead to memory corruption of         neighbouring heap memory.

    CVE-2025-0755

        The various bson_append functions in the MongoDB C driver library         may be susceptible to buffer overflow when performing operations         that could result in a final BSON document which exceeds the maximum         allowable size (INT32_MAX), resulting in a segmentation fault and         possible application crash.

    For Debian 11 bullseye, these problems have been fixed in version     1.17.6-1+deb11u1.

    We recommend that you upgrade your mongo-c-driver packages.

    For the detailed security status of mongo-c-driver please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mongo-c-driver

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Dell Wyse Management Suite installed on the remote host is prior to 5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2025-135 advisory.

  - Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information     Through Data Queries vulnerability. An unauthenticated attacker with remote access could potentially     exploit this vulnerability, leading to Information disclosure. (CVE-2025-29981)

  - Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions     vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability,     leading to Unauthorized access. (CVE-2025-29982)

  - Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool     vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability,     leading to Denial of service. (CVE-2025-27694)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command     listener configured by an application. The published events may contain security-sensitive data when     specific authentication-related commands are executed. Without due care, an application may inadvertently     expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an     application enables the command listener feature (this is not enabled by default). This issue affects the     MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver     1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to     4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++     Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0). (CVE-2021-32050)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
236989	Debian dla-4175 : libbson-1.0-0 - security update	Nessus	Debian Local Security Checks	high
233818	Dell Wyse Management Suite < 5.1 Multiple Vulnerabilities (DSA-2025-135)	Nessus	Windows	high
232213	Linux Distros Unpatched Vulnerability : CVE-2021-32050	Nessus	Misc.	high

Detections

Analytics

CVE-2021-32050

high

Tenable Plugins

high

high

high