CVE-2019-2391
MediumAdvisory
Published 10 Feb 2022In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.4
- base score, highest
- EPSS
- 0.009
- 57th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 15
- of 17,781 indexed, latest versions
- Container images
- 13
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Deserialization of Untrusted Data in bson
Carried by container images the latest versions of 15 of 17,781 indexed charts deploy, on 13 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| bsonnpm | 0.5.7, 1.0.4, 1.0.9, 1.1.3 | 1.1.4 | 13 |
- OSV records
- GHSA-4jwp-vfvf-657p
Charts affected
15 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| kongakonga | 1.1.0 | 1 of 1See more | 5,209 |
| Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher | 1.0.1 | 1 of 6See more | 19,187 |
| open5gsadaptivenetlabVerified publisher | 1.0.3 | 1 of 3See more | 25,443 |
| d.vazquezm.2021_helmapphelmVerified publisher | 1.0.0 | 1 of 6See more | 19,745 |
| openapiassist-iot-open-api-management | 0.2.2 | 1 of 6See more | 18,277 |
| istio-bookinfobookinfo | 1.2.2 | 1 of 6See more | 18,980 |
| kongacreate-databases | 0.1.0 | 1 of 1See more | 5,209 |
| wekan-oldgabisonfire | 0.1.2 | 1 of 1See more | 5,941 |
| streamsheetshelm-chartsVerified publisher | 0.2.3 | 4 of 8See more | 89,959 |
| istio-bookinfoistio-bookinfo | 1.2.2 | 1 of 6See more | 18,980 |
| sample-bookinfokubesphere-testVerified publisher | 1.0.0 | 1 of 4See more | 9,378 |
| myappp4-helm | 0.1.0 | 1 of 6See more | 19,720 |
| bookinforgnu | 1.0.0 | 1 of 7See more | 20,462 |
| istio-bookinforgnu | 1.0.2 | 1 of 7See more | 20,462 |
| wekanschmitzis | 1.1.1 | 1 of 1See more | 3,638 |
Container images carrying it
13 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| pantsel/ | c8172b75607d | bson | 1.1.4 | 3 |
| fjvela/ | 3c840aebce22 | bson | 1.1.4 | 2 |
| istio/ | 09b9d6958a13 | bson | 1.1.4 | 2 |
| istio/ | eb0f1a725ca8 | bson | 1.1.4 | 2 |
| davidvmar/ | 5663f5b24615 | bson | 1.1.4 | 1 |
| kubesphere/ | f1b5bf878196 | bson | 1.1.4 | 1 |
| wekanteam/ | 68a51f0327df | bson | 1.1.4 | 1 |
| ghcr.io/ | 0635f17c9d2c | bson | 1.1.4 | 1 |
| ghcr.io/ | e34964e336c1 | bson | 1.1.4 | 1 |
| ghcr.io/ | 0c5a3398d1e4 | bson | 1.1.4 | 1 |
| ghcr.io/ | 8ba040e79ca0 | bson | 1.1.4 | 1 |
| quay.io/ | cb17600883a3 | bson | 1.1.4 | 1 |
| registry.gitlab.com/ | fda21b0a0344 | bson | 1.1.4 | 1 |