Amazon Linux 2023 Security Advisory: ALAS2023-2026-3121
Advisory Released Date: 2026-09-29
Advisory Updated Date: 2026-09-29
Severity:
Important
Issue Overview:
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target. (CVE-2026-88029)
Affected Packages:
python-pymongo
Issue Correction:
Run dnf update python-pymongo --releasever 2023.12.20260928 or dnf update --advisory ALAS2023-2026-3121 --releasever 2023.12.20260928 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
python3-bson-debuginfo-3.10.1-5.amzn2023.0.4.aarch64
python-pymongo-debugsource-3.10.1-5.amzn2023.0.4.aarch64
python3-pymongo-gridfs-3.10.1-5.amzn2023.0.4.aarch64
python-pymongo-debuginfo-3.10.1-5.amzn2023.0.4.aarch64
python3-pymongo-3.10.1-5.amzn2023.0.4.aarch64
python3-pymongo-debuginfo-3.10.1-5.amzn2023.0.4.aarch64
python3-bson-3.10.1-5.amzn2023.0.4.aarch64
noarch:
python-pymongo-doc-3.10.1-5.amzn2023.0.4.noarch
src:
python-pymongo-3.10.1-5.amzn2023.0.4.src
x86_64:
python-pymongo-debuginfo-3.10.1-5.amzn2023.0.4.x86_64
python3-pymongo-debuginfo-3.10.1-5.amzn2023.0.4.x86_64
python3-pymongo-3.10.1-5.amzn2023.0.4.x86_64
python3-pymongo-gridfs-3.10.1-5.amzn2023.0.4.x86_64
python-pymongo-debugsource-3.10.1-5.amzn2023.0.4.x86_64
python3-bson-debuginfo-3.10.1-5.amzn2023.0.4.x86_64
python3-bson-3.10.1-5.amzn2023.0.4.x86_64