CVE-2010-1666: Buffer Overflow in python-cjson
Summary
CVE-2010-1666: Buffer overflow in Dan Pascu python-cjson 1.0.5, when UCS-4 encoding is enabled, allows context-dependent attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors i... Affects python-cjson versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-cjson is a Python extension module that provides a fast JSON encoder/decoder for Python. It is commonly used to serialize and deserialize JSON data. The vulnerability affects version 1.0.5 of python-cjson when UCS-4 encoding is enabled.
Vulnerability Detail
The vulnerability is a buffer overflow that can be triggered by passing crafted Unicode input to the cjson.encode function. This can lead to a denial of service (application crash) or potentially have other unspecified impacts. The issue arises due to a lack of proper input validation and handling of Unicode input.
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
pip install --upgrade "python-cjson==1.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The buffer overflow vulnerability in python-cjson can lead to a denial of service or other potential impacts. It is recommended to upgrade to version 1.1.0 or later to mitigate the issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-cjson →
FAQ
python-cjson is a Python extension module for fast JSON encoding/decoding.
Version 1.0.5 of python-cjson is affected.
The vulnerability can cause a denial of service (application crash) or have other unspecified impacts.
Upgrade to version 1.1.0 or later of python-cjson.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for python-cjson.
