MongoDB version 1.3.2 represents a minor update over the previous stable release, 1.3.1, within the popular Node.js driver for MongoDB. Both versions maintain the same core dependencies, relying on "bson" for efficient BSON serialization and deserialization, and offering optional Kerberos authentication through the "kerberos" package. The development dependencies, crucial for testing and building the library, remain consistent, with tools like "dox" for documentation generation, "ejs" for templating, "step" and "async" for asynchronous control flow, "gleak" for memory leak detection, "integra" for integration testing, "request" for HTTP requests, "markdown" for documentation formatting, "nodeunit" for unit testing, "optimist" for command-line argument parsing, and "uglify-js" for JavaScript minification.
The primary difference lies in the release date, with version 1.3.2 published on May 8, 2013, a couple of days after version 1.3.1 that was released on May 6, 2013. Although the provided data does not explicitly detail specific bug fixes or feature enhancements between these versions, developers should consider this update, however minor, as a potential source of stability improvements, bug resolutions, and performance optimizations. Checking the release notes or commit history on the linked GitHub repository ("http://github.com/mongodb/node-mongodb-native.git") is highly recommended for a comprehensive understanding of the changes incorporated in version 1.3.2. This allows developers to make informed decisions about upgrading and leveraging the most robust and reliable version of the MongoDB Node.js driver for their applications. If not explicitly addressed, upgrading from 1.3.1 to 1.3.2 it's suggested, since there are no breaking changes and the version is more recent.
All the vulnerabilities related to the version 1.3.2 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
