Skip to content
Fencer Vulns
medium 6.8

CVE-2021-20329 json

Specific cstrings input may not be properly validated in the Go Driver

published 2021-06-10 5 y ago modified 2026-06-17 4 mo ago also GHSA-f6mq-5m25-4r72 , GO-2021-0112 , EUVD-2021-1314

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.

Patch / fix

  • go go.mongodb.org/mongo-driver 1.5.1
  • etcd-for-k8s1.32 openSUSE Tumbleweed 3.5.24-1.1

opensuse advisories openSUSE-SU-2025:15764-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20329 updated cvss 6.5

mongo-go-driver: specific cstrings input may not be properly validated

  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9
    affected: no fix available
  • Red Hat OpenShift Developer Tools and Services jenkins-operator-container, ocp-tools-4/service-binding-rhel8-operator Red Hat OpenShift Serverless openshift-serverless-1/kn-client-kn-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-rhel8-operator Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator, 3scale-amp2/apicast-rhel9-operator
    affected: no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-tests, openshift4/ose-console, openshift4/ose-helm-operator, openshift4/ose-docker-builder, openshift4/ose-console-operator, openshift4/ose-cluster-bootstrap, +37 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-agent-rhel8 Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator, ocs4/volume-replication-rhel8-operator
    affected: no fix planned “Out of support scope”
  • Red Hat Openshift Data Foundation 4 odf4/odf-multicluster-rhel9-operator Red Hat OpenShift Data Science (RHODS) rhods/odh-operator-base-rhel8, rhods/odh-model-controller-rhel8, rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-modelmesh-serving-controller-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/kam-delivery-rhel8, openshift-gitops-1/applicationset-rhel8, openshift-gitops-1/gitops-rhel8-operator Red Hat OpenShift Virtualization 4 container-native-virtualization/virt-api
    affected: no fix available
  • Red Hat Quay 3 quay/quay-openshift-bridge-rhel8-operator
    affected: no fix planned “Will not fix”
show 9 more
  • Red Hat CNV 4.14 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.14.0--2023-113931
    fixed: vendor fix RHSA-2023:6817
  • Red Hat OpenShift Container Platform 4.9 openshift4/ose-csi-driver-nfs-rhel8 v4.9.0-202303281553.p0.g062018e.assembly.stream
    fixed: vendor fix RHSA-2023:1525
  • Red Hat OpenShift Container Platform 4.10 openshift4/ose-csi-driver-nfs-rhel8 v4.10.0-202303210741.p0.ge6b5664.assembly.stream, openshift4/ose-csi-driver-manila-rhel8-operator v4.10.0-202304031241.p0.g3b06768.assembly.stream
    fixed: vendor fix RHSA-2023:1656
  • Red Hat OpenShift Container Platform 4.11 openshift4/ose-csi-driver-manila-rhel8-operator v4.11.0-202303240327.p0.gce6c43b.assembly.stream
    fixed: vendor fix RHSA-2023:1504
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-csi-driver-manila-rhel8-operator v4.12.0-202303210718.p0.gaf25a1f.assembly.stream
    fixed: vendor fix RHSA-2023:1409
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-installer v4.13.0-202305091542.p0.g44db7b2.assembly.stream, openshift4/ose-olm-rukpak-rhel8 v4.13.0-202304190216.p0.g66b3e55.assembly.stream, openshift4/dpu-network-rhel8-operator v4.13.0-202308221627.p0.g35cbabd.assembly.stream, openshift4/ose-operator-lifecycle-manager v4.13.0-202401092010.p0.g2357f75.assembly.stream, openshift4/ose-baremetal-machine-controllers v4.13.0-202305030754.p0.gd20bc57.assembly.stream, openshift4/ose-csi-driver-manila-rhel8-operator v4.13.0-202304190216.p0.ge540ced.assembly.stream, +1 more
    fixed: vendor fix RHSA-2023:4730
  • Red Hat OpenShift Container Platform 4.14 openshift4/frr-rhel9 v4.14.0-202310201027.p0.g0414ca3.assembly.stream, openshift4/metallb-rhel8 v4.14.0-202310201027.p0.g73f6f31.assembly.stream, openshift4/ose-installer v4.14.0-202310201027.p0.g03546e5.assembly.stream, openshift4/ose-ptp-rhel9 v4.14.0-202310201027.p0.g80d08c5.assembly.stream, openshift4/ose-descheduler v4.14.0-202310201027.p0.g0fb0646.assembly.stream, openshift4/sriov-cni-rhel9 v4.14.0-202310201027.p0.gf73cb4b.assembly.stream, +64 more
    fixed: vendor fix RHSA-2023:5007
  • Red Hat RHOSSM 2.2 for RHEL 8 openshift-service-mesh/prometheus-rhel8 2.2.7-7
    fixed: vendor fix RHSA-2023:3645
  • Red Hat CNV 4.14 for RHEL 9 container-native-virtualization/pr-helper-rhel9 v4.14.0-395, container-native-virtualization/mtq-operator-rhel9 v4.14.0-82, container-native-virtualization/mtq-controller-rhel9 v4.14.0-83, container-native-virtualization/mtq-lock-server-rhel9 v4.14.0-83, container-native-virtualization/virtio-win-rhel9 v4.14.0--2023-113931, container-native-virtualization/kubemacpool-rhel9 v4.14.0--2023-113931, +37 more Red Hat Cost Management Metrics Operator costmanagement/costmanagement-metrics-rhel8-operator Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/opa-openshift-rhel8, openshift-logging/lokistack-gateway-rhel8, openshift-logging/cluster-logging-rhel8-operator Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-velero-plugin-for-aws-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-must-gather-api-rhel8
    +12 more products
    Red Hat OpenShift API for Data Protection oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8, oadp/oadp-kubevirt-velero-plugin-rhel9 Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 Red Hat OpenShift Serverless openshift-gitops-1/gitops-rhel8-operator Red Hat Advanced Cluster Management for Kubernetes 2 search-collector, search-aggregator, rhacm2/thanos-rhel7, rhacm2/prometheus-rhel9, rhacm2/acm-grafana-rhel8, rhacm2/observatorium-rhel8, +24 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat OpenShift Container Platform 4 openshift4/ose-pod, openshift4/ose-grafana, openshift4/ose-sdn-rhel8, openshift4/ose-telemeter, openshift4/ose-multus-cni, openshift4/cnf-tests-rhel8, +68 more Red Hat OpenShift Container Platform 4.9 redhat/redhat-operator-index v4.9, openshift4/ose-cli v4.9.0-202303281553.p0.g88cfeb4.assembly.stream, openshift4/ose-pod v4.9.0-202303281553.p0.g71d09da.assembly.stream, openshift4/ose-etcd v4.9.0-202303281553.p0.g784bbed.assembly.stream, openshift4/ose-tests v4.9.0-202303281553.p0.gd4545b8.assembly.stream, openshift4/ose-console v4.9.0-202303281553.p0.g6fa7856.assembly.stream, +149 more Red Hat OpenShift Container Platform 4.10 openshift4/ose-cli v4.10.0-202304032041.p0.g3a7500d.assembly.stream, openshift4/ose-pod v4.10.0-202303151454.p0.ga57ef08.assembly.stream, openshift4/ose-pod v4.10.0-202303301555.p0.g16bcd69.assembly.stream, openshift4/ose-etcd v4.10.0-202303301555.p0.gc3be56f.assembly.stream, openshift4/ose-tests v4.10.0-202303210954.p0.g450990b.assembly.stream, openshift4/ose-tests v4.10.0-202304032041.p0.g450990b.assembly.stream, +194 more Red Hat OpenShift Container Platform 4.11 openshift4/ose-cli v4.11.0-202303240327.p0.gdea6f47.assembly.stream, openshift4/ose-pod v4.11.0-202303240327.p0.gaf0420d.assembly.stream, openshift4/ose-etcd v4.11.0-202303240327.p0.gc637f9b.assembly.stream, openshift4/ose-tests v4.11.0-202303240327.p0.g968ffcd.assembly.stream, openshift4/ose-console v4.11.0-202303240327.p0.g095a741.assembly.stream, openshift4/ose-coredns v4.11.0-202303240327.p0.g227d727.assembly.stream, +174 more Red Hat OpenShift Container Platform 4.12 openshift4/ose-tests v4.12.0-202303211154.p0.g157761f.assembly.stream, openshift4/ose-console v4.12.0-202303212328.p0.g4bff1eb.assembly.stream, openshift4/ose-installer v4.12.0-202303210115.p0.g15d8ffe.assembly.stream, openshift4/ose-sdn-rhel8 v4.12.0-202303161041.p0.g64b64f9.assembly.stream, openshift4/ose-multus-cni v4.12.0-202303202115.p0.gd59f94d.assembly.stream, openshift4/ose-tools-rhel8 v4.12.0-202303211154.p0.g846602e.assembly.stream, +24 more Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202401100947-0, openshift4/ose-cli v4.13.0-202304190216.p0.g92b1a3d.assembly.stream, openshift4/ose-pod v4.13.0-202304211155.p0.gb404935.assembly.stream, openshift4/ose-pod v4.13.0-202401041732.p0.g9ed7eae.assembly.stream, openshift4/ose-ptp v4.13.0-202304190216.p0.g2a7524a.assembly.stream, openshift4/ose-ptp v4.13.0-202308221627.p0.gf1f9a62.assembly.stream, +294 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202310210434-0, openshift4/ose-cli v4.14.0-202310201027.p0.g0c63f9d.assembly.stream, openshift4/ose-pod v4.14.0-202310210404.p0.gf67aeb3.assembly.stream, openshift4/ose-tests v4.14.0-202310201027.p0.g948001a.assembly.stream, openshift4/ose-console v4.14.0-202310201027.p0.gc16ab01.assembly.stream, openshift4/ose-coredns v4.14.0-202310201027.p0.gfd70cf1.assembly.stream, +177 more
    not affected: vulnerable code not present

7 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.94% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go go.mongodb.org/mongo-driver
<1.5.1
1.5.1

Affected products

  • MongoDB Inc. MongoDB Go Driver

Classification

Weakness
  • CWE-1287 Improper Validation of Specified Type of Input
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.