Published: 05/07/2022 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions before 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ultrajson project ultrajson
fedoraproject fedora 35
fedoraproject fedora 36

Synopsis Moderate: Red Hat OpenStack Platform 1624 (python-ujson) security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python-ujson is now available for Red Hat OpenStack Platform1624 (Train) f ...

Synopsis Moderate: Red Hat OpenStack Platform 1619 (python-ujson) security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python-ujson is now available for Red Hat OpenStack Platform1619 (Train) f ...

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 37+ In versions prior to 540 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python This issue has bee ...

CWE-415 https://github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ff https://github.com/ultrajson/ultrajson/commit/9c20de0f77b391093967e25d01fb48671104b15b https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/https://access.redhat.com/errata/RHSA-2022:8850 https://nvd.nist.gov

CVE-2022-31117

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect