Source: ujson Version: 5.1.0-1 Severity: important Tags: security upstream Forwarded: https://github.com/ultrajson/ultrajson/issues/502 https://github.com/ultrajson/ultrajson/issues/501 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]> Control: found -1 4.0.2-1 Control: found -1 1.35-3
Hi, The following vulnerability was published for ujson. CVE-2021-45958[0]: | ** <A HREF="https://cve.mitre.org/about/faqs.html#disputed_signify_in_ | cve_entry">DISPUTED</A> ** UltraJSON (aka ujson) 4.0.2 through 5.0.0 | has a stack-based buffer overflow in Buffer_AppendIndentUnchecked | (called from encode). NOTE: multiple third parties dispute whether | this is a confirmed finding, because the event that caused the | Reproducer Testcase to stop indicating a buffer overflow was a change | to the AFLplusplus project (5525f8c9ef8bb879dadd0eb942d524827d1b0362), | not a change to the UltraJSON project. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2021-45958 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45958 [1] https://github.com/ultrajson/ultrajson/issues/502 [2] https://github.com/ultrajson/ultrajson/issues/501 Regards, Salvatore
