The MongoDB Node.js driver underwent a minor version update from 1.4.34 to 1.4.35, offering developers subtle improvements and refinements. Both versions share the same core dependencies: bson for BSON serialization, kerberos for authentication, and readable-stream for stream handling, ensuring a consistent base functionality for interacting with MongoDB databases. The development dependencies, crucial for testing and building, remain identical, including tools like dox for documentation, ejs for templating, step and async for asynchronous control flow, and nodeunit for unit testing. This indicates a focus on maintaining a stable development environment. Optional dependencies, kerberos and readable-stream, are also consistent, suggesting authentication and stream handling remain opt-in features handled the same way. The repository details and author information remain unchanged, highlighting the continued stewardship of the driver by the same team and codebase. The key difference lies in the dist object, specifically the tarball URL, which points to the respective package archives on the npm registry, and the releaseDate. Version 1.4.35 was released on March 21, 2015, while version 1.4.34 was released earlier on March 9, 2015. Developers should upgrade to 1.4.35 to benefit from any bug fixes or minor enhancements incorporated since the previous release. While the changes may be incremental, staying current ensures optimal performance and compatibility with the MongoDB database. Inspecting the changelog between these dates is highly recommended for those seeking detailed information on specific bug fixes or modifications.
All the vulnerabilities related to the version 1.4.35 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
DLL Injection in kerberos
Version of kerberos prior to 1.0.0 are vulnerable to DLL Injection. The package loads DLLs without specifying a full path. This may allow attackers to create a file with the same name in a folder that precedes the intended file in the DLL path search. Doing so would allow attackers to execute arbitrary code in the machine.
Upgrade to version 1.0.0 or later.
