search

db-migrate / mongodb

mongodb driver for db-migrate
Other
25 stars 58 forks source link

Update mongodb version to patch high severity vulnerability [$20] #40

Open ben833 opened 5 years ago

ben833 commented 5 years ago

There is a high severity vulnerability in the current version (1.5.0) - Denial of Service https://npmjs.com/advisories/1203

It does not pass npm audit. Please upgrade mongodb to version >=3.1.13 so it passes.

--- There is a **[$20 open bounty](https://www.bountysource.com/issues/82252859-update-mongodb-version-to-patch-high-severity-vulnerability?utm_campaign=plugin&utm_content=tracker%2F12293389&utm_medium=issues&utm_source=github)** on this issue. Add to the bounty at [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F12293389&utm_medium=issues&utm_source=github).
wzrdtales commented 5 years ago

Thanks for putting awareness on this issue. Since this is a major jump on the mongodb version I expected already a few tests to fail and problems to arise. If you're willing to help on this fixing for the latest mongodb version this will be warmheartedly welcomed.

I will look to put this into my schedule and see to fix the issues that come up with that upgrade, please don't hesitate to push the issue up should you feel no progress, to avoid it going under the radar since I am quite involved currently in multiple projects.

wzrdtales commented 5 years ago

On the master branch I put for reference already the newest mongodb version, tests are failing as described.

ben833 commented 5 years ago

I made a bit of progress, see https://github.com/db-migrate/mongodb/pull/41