PYSEC-2022-25
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/ujson/PYSEC-2022-25.yaml
- JSON Data
- https://api.test.osv.dev/v1/vulns/PYSEC-2022-25
- Aliases
- Published
- 2022-01-01T00:15:00Z
- Modified
- 2023-11-01T05:18:26.784169Z
- Summary
- [none]
- Details
-
UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
- References
-
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ujson/OSV-2021-955.yaml
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009
- https://github.com/ultrajson/ultrajson/issues/501
- https://github.com/ultrajson/ultrajson/issues/502#issuecomment-1031747284
- https://github.com/advisories/GHSA-fh56-85cw-5pq6
Affected packages
PyPI / ujson
Package
- Name
- ujson
- View open source insights on deps.dev
- Purl
- pkg:pypi/ujson