Описание
UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| ujson | fixed | 5.2.0-1 | package | |
| ujson | no-dsa | bullseye | package | |
| ujson | no-dsa | buster | package |
Примечания
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009
https://github.com/ultrajson/ultrajson/issues/501
https://github.com/ultrajson/ultrajson/issues/502
https://github.com/ultrajson/ultrajson/pull/504
Fixed by: https://github.com/ultrajson/ultrajson/pull/519
Связанные уязвимости
UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
