Описание
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.
A flaw was found in UltraJSON, a fast JSON encoder and decoder. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted large positive or negative indent value to the JSON serialization functions. This can lead to a buffer overflow, causing the Python interpreter to crash, or an infinite loop, making the application unresponsive. The issue stems from an integer overflow or underflow during memory allocation for indentation.
Отчет
This is an IMPORTANT denial of service flaw in UltraJSON, affecting Red Hat products that utilize python-ujson, including various Community Projects and Red Hat OpenStack Platform. The vulnerability arises when applications process untrusted input that controls the indent parameter in JSON serialization functions, potentially leading to a Python interpreter crash or an infinite loop. Exploitation requires a service to explicitly expose the indent parameter to untrusted users without proper validation.
Меры по смягчению последствий
To mitigate this issue, applications utilizing python-ujson should ensure that the indent parameter in ujson.dump(), ujson.dumps(), or ujson.encode() functions is not controlled by untrusted input. If untrusted input must influence indentation, restrict the indent value to reasonably small, non-negative integers. Review application code to identify and validate all uses of the indent parameter with external data.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenStack Platform 16.2 | python-ujson | Not affected | ||
| Red Hat OpenStack Platform 17.1 | python-ujson | Not affected | ||
| Red Hat OpenStack Platform 18.0 | python-ujson | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at...
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at le
UltraJSON is a fast JSON encoder and decoder written in pure C with bi ...
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
Уязвимость пакета UltraJSON языка программирования Python, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3