UBUNTU-CVE-2022-31116

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2022-31116

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-31116.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2022-31116

Upstream

CVE-2022-31116

Downstream

USN-6629-1

USN-6629-3

Related

Published

2022-07-05T18:15:00Z

Modified

2025-07-14T07:01:08.675050Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's json module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.

References

Affected packages

Ubuntu:Pro:14.04:LTS / pandas

Package

Name: pandas
Purl: pkg:deb/ubuntu/pandas@0.13.1-2ubuntu2?arch=source&distro=esm-infra-legacy/trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.12.0-2ubuntu1

0.13.1-2ubuntu1

0.13.1-2ubuntu2

Ubuntu:Pro:16.04:LTS / collada2gltf

Package

Name: collada2gltf
Purl: pkg:deb/ubuntu/collada2gltf@20140924-3?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

Other

20140924-3

Ubuntu:Pro:16.04:LTS / pandas

Package

Name: pandas
Purl: pkg:deb/ubuntu/pandas@0.17.1-3ubuntu2?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.15.0-2

0.15.0-2ubuntu1

0.15.0-2ubuntu2

0.17.1-3ubuntu2

Ubuntu:Pro:16.04:LTS / ujson

Package

Name: ujson
Purl: pkg:deb/ubuntu/ujson@1.33-1ubuntu0.1~esm2?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.33-1ubuntu0.1~esm2

Affected versions

1.*

1.33-1

1.33-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "1.33-1ubuntu0.1~esm2",
            "binary_name": "python-ujson"
        },
        {
            "binary_version": "1.33-1ubuntu0.1~esm2",
            "binary_name": "python-ujson-dbg"
        },
        {
            "binary_version": "1.33-1ubuntu0.1~esm2",
            "binary_name": "python3-ujson"
        },
        {
            "binary_version": "1.33-1ubuntu0.1~esm2",
            "binary_name": "python3-ujson-dbg"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Ubuntu:Pro:18.04:LTS / collada2gltf

Package

Name: collada2gltf
Purl: pkg:deb/ubuntu/collada2gltf@20140924-4?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

Other

20140924-4

Ubuntu:Pro:18.04:LTS / pandas

Package

Name: pandas
Purl: pkg:deb/ubuntu/pandas@0.22.0-4ubuntu1?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.19.2-5.1ubuntu4

0.22.0-2ubuntu1

0.22.0-3

0.22.0-4

0.22.0-4ubuntu1

Ubuntu:Pro:18.04:LTS / ujson

Package

Name: ujson
Purl: pkg:deb/ubuntu/ujson@1.35-2ubuntu0.1~esm1?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.35-2ubuntu0.1~esm1

Affected versions

1.*

1.35-1build2

1.35-2

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "1.35-2ubuntu0.1~esm1",
            "binary_name": "python-ujson"
        },
        {
            "binary_version": "1.35-2ubuntu0.1~esm1",
            "binary_name": "python-ujson-dbg"
        },
        {
            "binary_version": "1.35-2ubuntu0.1~esm1",
            "binary_name": "python3-ujson"
        },
        {
            "binary_version": "1.35-2ubuntu0.1~esm1",
            "binary_name": "python3-ujson-dbg"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Ubuntu:Pro:20.04:LTS / pandas

Package

Name: pandas
Purl: pkg:deb/ubuntu/pandas@0.25.3+dfsg-7?arch=source&distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.23.3+dfsg-4ubuntu1

0.23.3+dfsg-4ubuntu5

0.23.3+dfsg-4ubuntu6

0.25.3+dfsg-4

0.25.3+dfsg-4build1

0.25.3+dfsg-7

Ubuntu:Pro:20.04:LTS / ujson

Package

Name: ujson
Purl: pkg:deb/ubuntu/ujson@1.35-4ubuntu0.1+esm1?arch=source&distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.35-4ubuntu0.1+esm1

Affected versions

1.*

1.35-3build1

1.35-3build2

1.35-4

1.35-4build1

1.35-4ubuntu0.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "1.35-4ubuntu0.1+esm1",
            "binary_name": "python3-ujson"
        },
        {
            "binary_version": "1.35-4ubuntu0.1+esm1",
            "binary_name": "python3-ujson-dbg"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Ubuntu:22.04:LTS / collada2gltf

Package

Name: collada2gltf
Purl: pkg:deb/ubuntu/collada2gltf@20140924-8?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

Other

20140924-7build1

20140924-8

Ubuntu:22.04:LTS / pandas

Package

Name: pandas
Purl: pkg:deb/ubuntu/pandas@1.3.5+dfsg-3?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.1.5+dfsg-2

1.1.5+dfsg-2ubuntu1

1.3.5+dfsg-2

1.3.5+dfsg-2ubuntu1

1.3.5+dfsg-3

Ubuntu:22.04:LTS / ujson

Package

Name: ujson
Purl: pkg:deb/ubuntu/ujson@5.1.0-1build1?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.0.2-1

4.0.2-1build1

4.2.0-1

5.*

5.1.0-1

5.1.0-1build1

Ubuntu:Pro:22.04:LTS / ujson

Package

Name: ujson
Purl: pkg:deb/ubuntu/ujson@5.1.0-1ubuntu0.1~esm1?arch=source&distro=esm-apps/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.1.0-1ubuntu0.1~esm1

Affected versions

4.*

4.0.2-1

4.0.2-1build1

4.2.0-1

5.*

5.1.0-1

5.1.0-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "5.1.0-1ubuntu0.1~esm1",
            "binary_name": "python3-ujson"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Ubuntu:24.04:LTS / pandas

Package

Name: pandas
Purl: pkg:deb/ubuntu/pandas@2.1.4+dfsg-7?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.5.3+dfsg-6

1.5.3+dfsg-6ubuntu1

1.5.3+dfsg-7ubuntu1

1.5.3+dfsg-10

2.*

2.1.4+dfsg-4ubuntu2

2.1.4+dfsg-7

Ubuntu:25.04 / pandas

Package

Name: pandas
Purl: pkg:deb/ubuntu/pandas@2.2.3+dfsg-8build1?arch=source&distro=plucky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2.2+dfsg-4

2.2.3+dfsg-5

2.2.3+dfsg-5ubuntu1

2.2.3+dfsg-6ubuntu1

2.2.3+dfsg-7

2.2.3+dfsg-8

2.2.3+dfsg-8build1