—

PYSEC-2023-149

Quick fix

PYSEC-2023-149 — json2xml: upgrade to the fixed version with the command below.

pip install --upgrade 'json2xml>=3.14.0'

Details

The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/json2xml

Introduced in: 0Fixed in: 3.14.0

Fixpip install --upgrade 'json2xml>=3.14.0'

References

https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads/[WEB]
https://github.com/vinitkumar/json2xml/pull/107/files[WEB]
https://github.com/vinitkumar/json2xml/pull/107[WEB]
https://github.com/vinitkumar/json2xml/issues/106[REPORT]
https://github.com/advisories/GHSA-8rj5-2857-877j[ADVISORY]