CVE-2022-31117 — Double Free in Ultrajson

CWE-415 — Double Free12 documents6 sources
Severity
5.9MEDIUMNVD
OSV5.5
EPSS
0.2%
top 61.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
UltrajsonUltrajson Project UltrajsonDebian Ujson+1 more
Timeline
PublishedJul 5
Latest updateFeb 14

Description

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5ultrajson/ultrajson< 5.4.0
▶debiandebian/ujson< ujson 5.4.0-1 (bookworm)

Also affects: Fedora 35, 36

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

6
OSV
ujson vulnerability↗2024-02-14
▶
OSV
ujson vulnerabilities↗2024-02-14
▶
OSV
ujson vulnerabilities↗2024-02-14
▶
GHSA
Potential double free of buffer during string decoding↗2022-07-05
▶
OSV
Potential double free of buffer during string decoding↗2022-07-05
▶

📋Vendor Advisories

5
Ubuntu
UltraJSON vulnerabilities↗2024-02-14
▶
Ubuntu
UltraJSON vulnerability↗2024-02-14
▶
Ubuntu
UltraJSON vulnerabilities↗2024-02-14
▶
Red Hat
python-ujson: Potential double free of buffer during string decoding↗2022-07-02
▶
Debian
CVE-2022-31117: ujson - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for...↗2022
▶
CVE-2022-31117 — Double Free in Ultrajson | cvebase