CVE-2022-31116
Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.
How to fix
- ultrajson_project ultrajson5.4.0 or later
- ujson5.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ultrajson_project ultrajson | v < 5.4.0 | 5.4.0 |
| fedoraproject fedora | 35, 36 | — |
| ujsonPyPI | v < 5.4.0 | 5.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.