CVE-2022-31116
published 2022-07-05CVE-2022-31116: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.28%
81.2th percentile
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ujson | < ujson 5.4.0-1 (bookworm) | ujson 5.4.0-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| ultrajson | ultrajson | < 5.4.0 | 5.4.0 |
| ultrajson_project | ultrajson | < 5.4.0 | 5.4.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ujson vulnerability
osv·2024-02-14·CVSS 5.5
CVE-2021-45958 [MEDIUM] ujson vulnerability
ujson vulnerability
USN-6629-1 fixed vulnerabilities in UltraJSON.
This update provides the corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use this issue to corrupt memory. (CVE-2022-31117)
OSV
ujson vulnerabilities
osv·2024-02-14·CVSS 5.5
CVE-2021-45958 [MEDIUM] ujson vulnerabilities
ujson vulnerabilities
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use this issue to corrupt memory. (CVE-2022-31117)
OSV
ujson vulnerabilities
osv·2024-02-14·CVSS 5.5
CVE-2021-45958 [MEDIUM] ujson vulnerabilities
ujson vulnerabilities
USN-6629-1 fixed vulnerabilities in UltraJSON.
This update provides the corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use this issue to corrupt memory. (CVE-2022-31117)
OSV
Incorrect handling of invalid surrogate pair characters
osv·2022-07-05
CVE-2022-31116 [HIGH] Incorrect handling of invalid surrogate pair characters
Incorrect handling of invalid surrogate pair characters
### Impact
_What kind of vulnerability is it? Who is impacted?_
Anyone parsing JSON from an untrusted source is vulnerable.
JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries.
Examples:
```python
# An unpaired high surrogate character is ignored.
>>> ujson.loads(r'"\uD800"')
''
>>> ujson.loads(r'"\uD800hello"')
'hello'
# An unpaired low surrogate character is preserved.
>>> ujson.loads(r'"\uDC00"')
'\udc00'
# A pair of surrogates with additional non surrogate characters pair up in spite of being invalid.
>>> ujson.loads(r'"\uD800foo bar\uDC00"')
'foo bar𐀀'
`
OSV
CVE-2022-31116: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3
osv·2022-07-05·CVSS 7.5
CVE-2022-31116 [HIGH] CVE-2022-31116: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.
GHSA
Incorrect handling of invalid surrogate pair characters
ghsa·2022-07-05
CVE-2022-31116 [HIGH] CWE-670 Incorrect handling of invalid surrogate pair characters
Incorrect handling of invalid surrogate pair characters
### Impact
_What kind of vulnerability is it? Who is impacted?_
Anyone parsing JSON from an untrusted source is vulnerable.
JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries.
Examples:
```python
# An unpaired high surrogate character is ignored.
>>> ujson.loads(r'"\uD800"')
''
>>> ujson.loads(r'"\uD800hello"')
'hello'
# An unpaired low surrogate character is preserved.
>>> ujson.loads(r'"\uDC00"')
'\udc00'
# A pair of surrogates with additional non surrogate characters pair up in spite of being invalid.
>>> ujson.loads(r'"\uD800foo bar\uDC00"')
'foo bar𐀀'
`
Ubuntu
UltraJSON vulnerabilities
vendor_ubuntu·2024-02-14·CVSS 5.5
CVE-2022-31117 [MEDIUM] UltraJSON vulnerabilities
Title: UltraJSON vulnerabilities
Summary: Several security issues were fixed in UltraJSON.
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use this issue to corrupt memory. (CVE-2022-31117)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
UltraJSON vulnerability
vendor_ubuntu·2024-02-14·CVSS 5.5
CVE-2021-45958 [MEDIUM] UltraJSON vulnerability
Title: UltraJSON vulnerability
Summary: UltraJSON could be made to crash if it received specially crafted
input.
USN-6629-1 fixed vulnerabilities in UltraJSON.
This update provides the corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker
Ubuntu
UltraJSON vulnerabilities
vendor_ubuntu·2024-02-14·CVSS 5.5
CVE-2022-31117 [MEDIUM] UltraJSON vulnerabilities
Title: UltraJSON vulnerabilities
Summary: Several security issues were fixed in UltraJSON.
USN-6629-1 fixed vulnerabilities in UltraJSON.
This update provides the corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use thi
Red Hat
python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting
vendor_redhat·2022-07-02·CVSS 7.5
CVE-2022-31116 [HIGH] CWE-228 python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting
python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for
Debian
CVE-2022-31116: ujson - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for...
vendor_debian·2022·CVSS 7.5
CVE-2022-31116 [HIGH] CVE-2022-31116: ujson - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for...
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.
Scope: local
bookworm: resolved (fixed in 5.4.0-1)
bullseye: open
forky: resolved (fixed in 5.4.0-1)
sid: resolved (fi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/ultrajson/ultrajson/commit/67ec07183342589d602e0fcf7bb1ff3e19272687https://github.com/ultrajson/ultrajson/security/advisories/GHSA-wpqr-jcpx-745rhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/https://github.com/ultrajson/ultrajson/commit/67ec07183342589d602e0fcf7bb1ff3e19272687https://github.com/ultrajson/ultrajson/security/advisories/GHSA-wpqr-jcpx-745rhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/
2022-07-05
Published