MongoDB version 1.3.5 represents a minor update to the popular Node.js driver for MongoDB, following closely on the heels of version 1.3.4. Both versions provide developers with a robust and feature-rich interface for interacting with MongoDB databases. The core functionality remains consistent, offering tools for connecting to databases, performing CRUD operations (Create, Read, Update, Delete), and managing indexes and collections.
The primary differentiator between versions 1.3.4 and 1.3.5 lies in bug fixes, performance improvements, or very minor feature additions. Developers upgrading from 1.3.4 to 1.3.5 can expect a more stable and potentially slightly more efficient experience. The dependencies, including bson for handling binary JSON and kerberos for authentication, remain the same. Similarly, the development dependencies, used for testing and building the package, are also unchanged.
While specific details of the changes implemented from 1.3.4 to 1.3.5 are unverified, such updates often address edge cases or resolve compatibility issues discovered in the previous version. For developers relying on the MongoDB Node.js driver, staying current with the latest minor version is generally recommended to benefit from these improvements and ensure optimal performance. The release date of 1.3.5 being two days after 1.3.4 suggests the changes migth be tied to urgent bug fixes.
All the vulnerabilities related to the version 1.3.5 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
