Detections
Analytics

GLSA-202403-03 : UltraJSON: Multiple Vulnerabilities

high Nessus Plugin ID 191479

Language:

Description

The remote host is affected by the vulnerability described in GLSA-202403-03 (UltraJSON: Multiple Vulnerabilities)

 - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-31116)

 - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue. (CVE-2022-31117)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

All UltraJSON users should upgrade to the latest version:

 # emerge --sync # emerge --ask --oneshot --verbose >=dev-python/ujson-5.4.0

See Also

https://security.gentoo.org/glsa/202403-03

https://bugs.gentoo.org/show_bug.cgi?id=855689

Plugin Details

Severity: High

ID: 191479

File Name: gentoo_GLSA-202403-03.nasl

Version: 1.0

Type: local

Published: 3/3/2024

Updated: 3/3/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2022-31116

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:ujson, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/3/2024

Vulnerability Publication Date: 7/2/2022

Reference Information

CVE: CVE-2022-31116, CVE-2022-31117