- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202403-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: UltraJSON: Multiple Vulnerabilities
Date: March 03, 2024
Bugs: #855689
ID: 202403-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been discovered in UltraJSON, the worst of
which could lead to key confusion and value overwriting.

Background
==========

UltraJSON is an ultra fast JSON encoder and decoder written in pure C
with bindings for Python 3.8+.

Affected packages
=================

Package Vulnerable Unaffected
---------------- ------------ ------------
dev-python/ujson < 5.4.0 >= 5.4.0

Description
===========

Affected versions were found to improperly decode certain characters.
JSON strings that contain escaped surrogate characters not part of a
proper surrogate pair were decoded incorrectly. Besides corrupting
strings, this allowed for potential key confusion and value overwriting
in dictionaries. All users parsing JSON from untrusted sources are
vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the
same way as the standard library's `json` module does, preserving them
in the parsed output.

Impact
======

Please review the referenced CVE identifiers for details.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All UltraJSON users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-python/ujson-5.4.0"

References
==========

[ 1 ] CVE-2022-31116
https://nvd.nist.gov/vuln/detail/CVE-2022-31116
[ 2 ] CVE-2022-31117
https://nvd.nist.gov/vuln/detail/CVE-2022-31117

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202403-03

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to [email protected] or alternatively, you may file a bug at https://bugs.gentoo.org.

License
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmXkVH8ACgkQFMQkOaVy +9ksUxAAlK3TNZa3l3/9Czoc2jQMUvN/kwRu+7+dumdmxy//9Mm5bapILTgYnt61 5DZzCuJZmeEZPZNtUlEdsqcoEOZ1Yq0h0VBlB69AkFrZPgZ7eNN2VIGzOSPjMcsM XobMl14ozUtIYL4yyyA15KFkGBbZnTuzJ7o1pzoEQmB6WyVhG758tYCpQkSI0D63 aZF3WuZBDdSCk9DTRPPADFESS8qPgvWl0L4Xgfw4a6mVEshDevYLWnrlQ8kHPKE3 PPJYwTXWhFbXj0WzGxum3dHzRErD05CwA3KnsuwhPre+U3OXEaxAKZ1dc2ee11O0 0iPO7MnmOShW7LvBRNu4RvUsG4Z54MgX2vXVi1TZgBW+KEb2bPwQsuKwU5wr50Zw rQ9Nqj4v15DRC3SshsxdNmnLWY3Xn0WOcjMkkOT+++e4R0vqF3Ketand3EnTSKQK 4eT+8pXqRgyY+oSoabb0jHcSHnFl1PdJCx3revDrWwtqk6dJeiadiM0YLMD2FBe9 2MLgLmnpVUk51EBhwnwG66yHn0S2M/4VNmdhTYjn3VacAxkfFurS0nhHsIXJGndd 217Tp0KDoB9kVH/gDL0dUMeuVmBYaJllyS0URaPJm4TI/x1IGPU29IuHm7ElUias kph2ptTVplh0z4mlRCsiQNjbUVZv4M+y6k0gkL659CvlO2z4jCc=
=c6CG
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)