CVE-2022-31117
published 2022-07-05CVE-2022-31117: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating…
PriorityP430medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
1.68%
74.4th percentile
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ujson | < ujson 5.4.0-1 (bookworm) | ujson 5.4.0-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| ultrajson | ultrajson | < 5.4.0 | 5.4.0 |
| ultrajson_project | ultrajson | < 5.4.0 | 5.4.0 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ujson vulnerability
osv·2024-02-14·CVSS 5.5
CVE-2021-45958 [MEDIUM] ujson vulnerability
ujson vulnerability
USN-6629-1 fixed vulnerabilities in UltraJSON.
This update provides the corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use this issue to corrupt memory. (CVE-2022-31117)
OSV
ujson vulnerabilities
osv·2024-02-14·CVSS 5.5
CVE-2021-45958 [MEDIUM] ujson vulnerabilities
ujson vulnerabilities
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use this issue to corrupt memory. (CVE-2022-31117)
OSV
ujson vulnerabilities
osv·2024-02-14·CVSS 5.5
CVE-2021-45958 [MEDIUM] ujson vulnerabilities
ujson vulnerabilities
USN-6629-1 fixed vulnerabilities in UltraJSON.
This update provides the corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use this issue to corrupt memory. (CVE-2022-31117)
GHSA
Potential double free of buffer during string decoding
ghsa·2022-07-05
CVE-2022-31117 [MEDIUM] CWE-415 Potential double free of buffer during string decoding
Potential double free of buffer during string decoding
### Impact
_What kind of vulnerability is it? Who is impacted?_
When an error occurs while reallocating the buffer for string decoding, the buffer gets freed twice.
Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
Users should upgrade to UltraJSON 5.4.0.
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
There is no workaround.
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [UltraJSON](http://github.com/ultrajson/ultrajson/issues)
OSV
Potential double free of buffer during string decoding
osv·2022-07-05
CVE-2022-31117 [MEDIUM] Potential double free of buffer during string decoding
Potential double free of buffer during string decoding
### Impact
_What kind of vulnerability is it? Who is impacted?_
When an error occurs while reallocating the buffer for string decoding, the buffer gets freed twice.
Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
Users should upgrade to UltraJSON 5.4.0.
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
There is no workaround.
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [UltraJSON](http://github.com/ultrajson/ultrajson/issues)
OSV
CVE-2022-31117: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3
osv·2022-07-05·CVSS 5.9
CVE-2022-31117 [MEDIUM] CVE-2022-31117: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.
Ubuntu
UltraJSON vulnerabilities
vendor_ubuntu·2024-02-14·CVSS 5.5
CVE-2022-31117 [MEDIUM] UltraJSON vulnerabilities
Title: UltraJSON vulnerabilities
Summary: Several security issues were fixed in UltraJSON.
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use this issue to corrupt memory. (CVE-2022-31117)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
UltraJSON vulnerability
vendor_ubuntu·2024-02-14·CVSS 5.5
CVE-2021-45958 [MEDIUM] UltraJSON vulnerability
Title: UltraJSON vulnerability
Summary: UltraJSON could be made to crash if it received specially crafted
input.
USN-6629-1 fixed vulnerabilities in UltraJSON.
This update provides the corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker
Ubuntu
UltraJSON vulnerabilities
vendor_ubuntu·2024-02-14·CVSS 5.5
CVE-2022-31117 [MEDIUM] UltraJSON vulnerabilities
Title: UltraJSON vulnerabilities
Summary: Several security issues were fixed in UltraJSON.
USN-6629-1 fixed vulnerabilities in UltraJSON.
This update provides the corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use thi
Red Hat
python-ujson: Potential double free of buffer during string decoding
vendor_redhat·2022-07-02·CVSS 5.9
CVE-2022-31117 [MEDIUM] CWE-415 python-ujson: Potential double free of buffer during string decoding
python-ujson: Potential double free of buffer during string decoding
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.
Package: python-ujson (Red Hat OpenStack Platform 13 (Queens)) - Out of support scope
Debian
CVE-2022-31117: ujson - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for...
vendor_debian·2022·CVSS 5.9
CVE-2022-31117 [MEDIUM] CVE-2022-31117: ujson - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for...
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.
Scope: local
bookworm: resolved (fixed in 5.4.0-1)
bullseye: open
forky: resolved (fixed in 5.4.0-1)
sid: resolved (fixed in 5.4.0-1)
trixie: resolved (fixed in 5.4.0-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/ultrajson/ultrajson/commit/9c20de0f77b391093967e25d01fb48671104b15bhttps://github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ffhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/https://github.com/ultrajson/ultrajson/commit/9c20de0f77b391093967e25d01fb48671104b15bhttps://github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ffhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/
2022-07-05
Published