VDB
Sign up
—

PYSEC-2022-25

Quick fix

PYSEC-2022-25 — ujson: upgrade to the fixed version with the command below.

pip install --upgrade 'ujson>=5.1.0'

Details

UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/ujson
Introduced in: 4.0.2Fixed in: 5.1.0
Fixpip install --upgrade 'ujson>=5.1.0'

References