Cross-Site Scripting (XSS) in python-cjson 1.0.5
Summary
CVE-2009-4924: Dan Pascu python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firefox and the end tag o... Affects python-cjson versions < 1.0.5-4. Fixed in 1.0.5-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-cjson is a Python extension module that provides fast JSON encoding and decoding. It is commonly used in Python applications to handle JSON data. However, versions prior to 1.0.5 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability (CVE-2009-4924) in python-cjson 1.0.5 arises from improper handling of a ['/'] argument to cjson.encode. This flaw can be exploited by remote attackers to conduct certain XSS attacks involving Firefox and the end tag of a SCRIPT element. The impact of this vulnerability can lead to unauthorized script execution in the context of a victim's browser, potentially compromising sensitive information or performing malicious actions.
How To Fix
Minimum fixed version
1.0.5-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-cjsonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The python-cjson package prior to version 1.0.5-4 is vulnerable to a cross-site scripting (XSS) attack. It is crucial to update to the fixed version to mitigate the risk of unauthorized script execution. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python-cjson →
FAQ
python-cjson is a Python extension module that provides fast JSON encoding and decoding capabilities.
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to unauthorized script execution in a victim's browser.
To fix this vulnerability, upgrade python-cjson to version 1.0.5-4 or later.
No specific workarounds have been provided for this vulnerability.
For more information, you can refer to the CVE-2009-4924 entry or contact the package maintainers.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-cjson.
