Fluid Attacks Database

Description

UltraJSON vulnerable to Out-of-bounds Write UltraJSON (aka ujson) 1.34 through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	ujson	>=0 <5.2.0-1	5.2.0-1
debian 14	ujson	>=0 <5.2.0-1	5.2.0-1
pypi	ujson	>=1.34 <5.2.0	5.2.0
debian 11	ujson	=4.0.2-1 \|\| =4.2.0-1 \|\| =5.1.0-1 \|\| =5.10.0-1 \|\| =5.11.0-1 \|\| =5.11.0-2 \|\| =5.11.0-3 \|\| =5.2.0-1 \|\| =5.3.0-1 \|\| =5.4.0-1 \|\| =5.5.0-1 \|\| =5.5.0-2 \|\| =5.6.0-1 \|\| =5.7.0-1 \|\| =5.8.0-1 \|\| =5.9.0-1	-
debian 13	ujson	>=0 <5.2.0-1	5.2.0-1

Aliases

1. CVE-2021-459582. NVD-2021-459583. OSV-DEBIAN-2021-459584. OSV-2021-459585. GHSA-fh56-85cw-5pq66. GCVE-2021-459587. SECURITY-TRACKER-CVE-2021-459588. lists.debian.org

References

1. https://github.com/ultrajson/ultrajson/issues/5012. https://github.com/ultrajson/ultrajson/issues/502#issuecomment-10317472843. https://github.com/ultrajson/ultrajson/pull/5044. https://github.com/ultrajson/ultrajson/pull/5195. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=360096. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ujson/OSV-2021-955.yaml7. https://github.com/pypa/advisory-database/tree/main/vulns/ujson/PYSEC-2022-25.yaml8. https://lists.fedoraproject.org/archives/list/[email protected]/message/CN7W3GOXALINKFUUE7ICQIC2EF5HNKUQ9. https://lists.fedoraproject.org/archives/list/[email protected]/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD210. https://lists.fedoraproject.org/archives/list/[email protected]/message/O6JUWQTJLA2CMG4CJN7DCUVSOXLZIIXL11. https://lists.fedoraproject.org/archives/list/[email protected]/message/ULX35TSWLBBIMEH44MUORPXYYRZKEDC6

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.