Vulnerability Description
UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ultrajson Project | Ultrajson | < 5.2.0 |
| Debian | Debian Linux | 9.0 |
| Fedoraproject | Fedora | 35 |
Related Weaknesses (CWE)
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009ExploitIssue TrackingThird Party Advisory
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ujson/OSV-2021-955.yamlExploitThird Party Advisory
- https://github.com/ultrajson/ultrajson/issues/501ExploitIssue TrackingThird Party Advisory
- https://github.com/ultrajson/ultrajson/issues/502#issuecomment-1031747284Issue TrackingPatchThird Party Advisory
- https://github.com/ultrajson/ultrajson/pull/504PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/02/msg00023.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009ExploitIssue TrackingThird Party Advisory
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ujson/OSV-2021-955.yamlExploitThird Party Advisory
- https://github.com/ultrajson/ultrajson/issues/501ExploitIssue TrackingThird Party Advisory
- https://github.com/ultrajson/ultrajson/issues/502#issuecomment-1031747284Issue TrackingPatchThird Party Advisory
- https://github.com/ultrajson/ultrajson/pull/504PatchThird Party Advisory
FAQ
What is CVE-2021-45958?
CVE-2021-45958 is a vulnerability with a CVSS score of 5.5 (MEDIUM). UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
How severe is CVE-2021-45958?
CVE-2021-45958 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-45958?
Check the references section above for vendor advisories and patch information. Affected products include: Ultrajson Project Ultrajson, Debian Debian Linux, Fedoraproject Fedora.