MongoDB version 1.4.9 represents a minor update to the popular Node.js driver for MongoDB databases, building upon the foundation of version 1.4.8. Both versions offer essential tools for interacting with MongoDB, enabling developers to perform CRUD operations, manage connections, and leverage the power of MongoDB's document-oriented database model within their Node.js applications. A key difference lies in the dependencies: version 1.4.9 upgrades the bson dependency to version 0.2.12, whereas version 1.4.8 utilizes bson version 0.2.11. This bson update likely includes performance improvements and bug fixes related to the Binary JSON serialization format, which is crucial for efficient data handling within MongoDB.
Developers using the mongodb package should be aware of this bson update as it may impact the serialization and deserialization of data. Although seemingly small, dependency updates can introduce breaking changes or resolve critical issues. Both versions share identical devDependencies, suggesting a consistent development and testing environment. They offer the same core functionality for working with MongoDB, leveraging libraries like kerberos for authentication and readable-stream for managing data streams. The releaseDate shows a more recent build date for 1.4.9, indicating a response to issues encountered in the previous version or new possible features. Before upgrading, developers are advised to review the changelog for the bson package and the mongodb driver to ensure compatibility and avoid unforeseen circumstances.
All the vulnerabilities related to the version 1.4.9 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
DLL Injection in kerberos
Version of kerberos prior to 1.0.0 are vulnerable to DLL Injection. The package loads DLLs without specifying a full path. This may allow attackers to create a file with the same name in a folder that precedes the intended file in the DLL path search. Doing so would allow attackers to execute arbitrary code in the machine.
Upgrade to version 1.0.0 or later.
