Buffer Overflow Vulnerability in UltraJSON (ujson) Package
Summary
CVE-2021-45958: UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Affects ujson versions < f6860f1f3d8d4e92b9be0e5815355a8976c6e75b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UltraJSON, commonly referred to as ujson, is a high-performance JSON encoding and decoding library for Python. It is designed to provide faster JSON processing compared to the standard library. The library is widely used in applications that require efficient data interchange. However, versions up to 5.1.0 are susceptible to a stack-based buffer overflow, which can lead to severe security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2021-45958, arises from a stack-based buffer overflow in the Buffer_AppendIndentUnchecked function, which is invoked during the encoding process. This flaw allows an attacker to exploit the vulnerability by providing a large amount of indentation, potentially leading to arbitrary code execution or application crashes. The issue affects multiple versions of the ujson package, making it critical for users to address this vulnerability promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to limit the amount of indentation used in JSON encoding. This can be achieved by modifying the encoding function to use a smaller value for indentation, thus avoiding the overflow condition.
Conclusion
The buffer overflow vulnerability in the UltraJSON (ujson) package poses significant risks to applications using affected versions. Users are strongly advised to upgrade to the latest version to mitigate potential security threats. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for ujson →
FAQ
CVE-2021-45958 is a vulnerability in the UltraJSON (ujson) package that allows for a stack-based buffer overflow, potentially leading to arbitrary code execution.
All versions of ujson up to and including 5.1.0 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
The CVSS score for CVE-2021-45958 is 5.5, indicating a moderate level of severity.
If an immediate upgrade is not feasible, consider limiting the indentation used in JSON encoding as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for ujson.
