===================================================================                                 CERT-Renater

                     Note d'Information No. 2022/VULN236

_____________________________________________________________________

DATE                : 06/07/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running ujson (pip) versions prior to
                                      5.4.0.

====================================================================https://github.com/ultrajson/ultrajson/security/advisories/GHSA-wpqr-jcpx-745r
https://github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ff
_____________________________________________________________________


Incorrect handling of invalid surrogate pair characters
Moderate   hugovk published GHSA-wpqr-jcpx-745r


Package
ujson (pip)

Affected versions
< 5.4.0

Patched versions
5.4.0


Description

Impact

What kind of vulnerability is it? Who is impacted?

Anyone parsing JSON from an untrusted source is vulnerable.

JSON strings that contain escaped surrogate characters not part of a 
proper surrogate pair were decoded incorrectly. Besides corrupting 
strings, this allowed for potential key confusion and value overwriting 
in dictionaries.

Examples:

# An unpaired high surrogate character is ignored.
>>> ujson.loads(r'"\uD800"')
''
>>> ujson.loads(r'"\uD800hello"')
'hello'

# An unpaired low surrogate character is preserved.
>>> ujson.loads(r'"\uDC00"')
'\udc00'

# A pair of surrogates with additional non surrogate characters pair up 
in spite of being invalid.

>>> ujson.loads(r'"\uD800foo bar\uDC00"')
'foo bar𐀀'


Patches

Has the problem been patched? What versions should users upgrade to?

Users should upgrade to UltraJSON 5.4.0.

 From version 5.4.0, UltraJSON decodes lone surrogates in the same way 
as the standard library's json module does, preserving them in the 
parsed output:

>>> ujson.loads(r'"\uD800"')
'\ud800'
>>> ujson.loads(r'"\uD800hello"')
'\ud800hello'
>>> ujson.loads(r'"\uDC00"')
'\udc00'
>>> ujson.loads(r'"\uD800foo bar\uDC00"')
'\ud800foo bar\udc00'

Workarounds

Is there a way for users to fix or remediate the vulnerability without 
upgrading?

Short of switching to an entirely different JSON library, there are no 
safe alternatives to upgrading.


For more information

If you have any questions or comments about this advisory:

     Open an issue in UltraJSON


Severity
Moderate

CVE ID
CVE-2022-31116

Weaknesses
CWE-228

Credits
     @JustAnotherArchivist JustAnotherArchivist
     @the-bumble the-bumble


_____________________________________________________________________


Potential double free of buffer during string decoding
Low   hugovk published GHSA-fm67-cv37-96ff


Package
ujson (pip)

Affected versions
< 5.4.0

Patched versions
5.4.0


Description

Impact

What kind of vulnerability is it? Who is impacted?

When an error occurs while reallocating the buffer for string decoding, 
the buffer gets freed twice.

Due to how UltraJSON uses the internal decoder, this double free is 
impossible to trigger from Python.


Patches

Has the problem been patched? What versions should users upgrade to?

Users should upgrade to UltraJSON 5.4.0.


Workarounds

Is there a way for users to fix or remediate the vulnerability without 
upgrading?

There is no workaround.


For more information

If you have any questions or comments about this advisory:

     Open an issue in UltraJSON


Severity
Low

CVE ID
CVE-2022-31117

Weaknesses
CWE-415

Credits
     @JustAnotherArchivist JustAnotherArchivist



========================================================+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=======================================================