CVE-2021-20329: 
Red Hat Enterprise Linux CoreOS (RHCOS) vulnerability analysis and mitigation

CVE-2021-20329 is a security vulnerability discovered in the MongoDB Go Driver affecting all versions up to and including 1.5.0. The vulnerability was related to improper validation of specific cstrings input when marshalling Go objects into BSON. The issue was disclosed and addressed with the release of MongoDB Go Driver version 1.5.1 (MongoDB Release).

The vulnerability stems from the BSON marshalling system's incorrect handling of null bytes embedded in BSON key names and the pattern/options fields of a BSON regex value. The issue has a CVSS v3.1 score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating moderate severity (MongoDB Release).

When exploited, this vulnerability could allow a malicious user to potentially inject additional fields into marshalled documents through a Go object with specific string manipulation (MongoDB Release).

The vulnerability requires a low level of privileges but high attack complexity to exploit. It can be accessed through the network without requiring user interaction (MongoDB Release).

The vulnerability was fixed in MongoDB Go Driver version 1.5.1. The fix includes proper validation that now correctly identifies and returns an error if there is an embedded null byte in BSON key names or the pattern/options fields of a BSON regex value. Users are strongly recommended to upgrade to version 1.5.1 or later (MongoDB Release).