- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 202403-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal
    Title: UltraJSON: Multiple Vulnerabilities
     Date: March 03, 2024
     Bugs: #855689
       ID: 202403-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been discovered in UltraJSON, the worst of
which could lead to key confusion and value overwriting.

Background
==========

UltraJSON is an ultra fast JSON encoder and decoder written in pure C
with bindings for Python 3.8+.

Affected packages
=================

Package           Vulnerable    Unaffected
----------------  ------------  ------------
dev-python/ujson  < 5.4.0       >= 5.4.0

Description
===========

Affected versions were found to improperly decode certain characters.
JSON strings that contain escaped surrogate characters not part of a
proper surrogate pair were decoded incorrectly. Besides corrupting
strings, this allowed for potential key confusion and value overwriting
in dictionaries. All users parsing JSON from untrusted sources are
vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the
same way as the standard library's `json` module does, preserving them
in the parsed output.

Impact
======

Please review the referenced CVE identifiers for details.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All UltraJSON users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=dev-python/ujson-5.4.0"

References
==========

[ 1 ] CVE-2022-31116
      https://nvd.nist.gov/vuln/detail/CVE-2022-31116
[ 2 ] CVE-2022-31117
      https://nvd.nist.gov/vuln/detail/CVE-2022-31117

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202403-03

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5