MongoDB Node.js driver version 1.4.24 introduces subtle but important changes compared to the 1.4.23 release, making it essential for developers relying on the package. The core change lies within the dependencies: kerberos moves from version 0.0.6 to 0.0.7, potentially addressing security vulnerabilities or performance enhancements. Furthermore, the mongodb-core dependency sees an update from version 1.1.3 to 1.1.6, hinting at internal improvements, possible bug fixes, and refined MongoDB server interaction. These modifications at the core level could impact data handling and connection stability, so developers should evaluate their usage and test appropriately.
While on the surface most dependencies stay the same, these point updates touch on the underlying mechanics. It's worth noting the update also brings about changes in the devDependencies, which are not critical for operation, but more useful for development and testing environments, in order to provide greater stability and reliabilty. Version 1.4.24 offers the same API and general functionality as 1.4.23, but with likely improved stability, security, and performance originating from its key dependencies. Developers adopting this version should review any related changes in the kerberos and mongodb-core changelogs to fully understand the implications and to ensure seamless integration into their existing applications. The update has been released on December 18th 2014, about two weeks later than the previous one.
All the vulnerabilities related to the version 1.4.24 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
DLL Injection in kerberos
Version of kerberos prior to 1.0.0 are vulnerable to DLL Injection. The package loads DLLs without specifying a full path. This may allow attackers to create a file with the same name in a folder that precedes the intended file in the DLL path search. Doing so would allow attackers to execute arbitrary code in the machine.
Upgrade to version 1.0.0 or later.
