CVE-2021-45958: UltraJSON Out-of-bounds Write Vulnerability
Summary
CVE-2021-45958: UltraJSON vulnerable to Out-of-bounds Write. Affects ujson versions >= 1.34, < 5.2.0. Fixed in 5.2.0. How to fix ↓
Also tracked for
- ujson · Debian:11
The same CVE-2021-45958 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UltraJSON (aka ujson) is a Python library that provides fast and efficient JSON encoding and decoding capabilities. It is commonly used in Python applications to handle JSON data. However, versions 1.34 through 5.1.0 of UltraJSON are vulnerable to an out-of-bounds write vulnerability. This vulnerability occurs in the Buffer_AppendIndentUnchecked function, which is called from the encode function. An attacker could exploit this vulnerability to trigger a stack-based buffer overflow, potentially leading to arbitrary code execution or a denial of service condition.
Vulnerability Detail
The UltraJSON vulnerability (CVE-2021-45958) arises due to a stack-based buffer overflow in the Buffer_AppendIndentUnchecked function. This function is called during the encoding process and is susceptible to an out-of-bounds write. An attacker can craft a malicious JSON payload that triggers the buffer overflow, potentially allowing them to execute arbitrary code or cause the application to crash. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.5.
How To Fix
Minimum fixed version
5.2.0
This is the first release that contains the fix.
pip install --upgrade "ujson==5.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The UltraJSON library is vulnerable to an out-of-bounds write issue, which can be exploited by an attacker to execute arbitrary code or cause a denial of service. It is crucial to upgrade to version 5.2.0 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ujson →
FAQ
UltraJSON (aka ujson) is a Python library that provides fast and efficient JSON encoding and decoding capabilities.
Versions 1.34 through 5.1.0 of UltraJSON are affected by this vulnerability.
This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service condition.
Yes, upgrading to version 5.2.0 or later of UltraJSON fixes this vulnerability.
You can update the ujson package by running the command 'pip install --upgrade ujson'.
References
Related vulnerabilities
Recent vulnerabilities recorded for ujson.
