CVE-2022-31117

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-31117
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://github.com/ultrajson/ultrajson/commit/9c20de0f77b391093967e25d01fb48671104b15b Patch Third Party Advisory
https://github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ff Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/
Configurations

Configuration 1 (hide)

cpe:2.3:a:ultrajson_project:ultrajson:*:*:*:*:*:python:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
History

07 Nov 2023, 03:47

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/', 'name': 'FEDORA-2022-1b2b8d5177', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/', 'name': 'FEDORA-2022-33e816bc37', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/ -

05 Nov 2022, 02:47

Type Values Removed Values Added
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/ - Mailing List, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/ - Mailing List, Third Party Advisory
CPE cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
First Time Fedoraproject
Fedoraproject fedora

03 Aug 2022, 04:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/ -

23 Jul 2022, 04:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/ -

14 Jul 2022, 11:41

Type Values Removed Values Added
First Time Ultrajson Project ultrajson
Ultrajson Project
CVSS v2 : unknown
v3 : unknown 		v2 : 4.3
v3 : 5.9
CPE cpe:2.3:a:ultrajson_project:ultrajson:*:*:*:*:*:python:*:*
References (MISC) https://github.com/ultrajson/ultrajson/commit/9c20de0f77b391093967e25d01fb48671104b15b - (MISC) https://github.com/ultrajson/ultrajson/commit/9c20de0f77b391093967e25d01fb48671104b15b - Patch, Third Party Advisory
References (CONFIRM) https://github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ff - (CONFIRM) https://github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ff - Third Party Advisory

05 Jul 2022, 18:21

Type Values Removed Values Added
New CVE
Information

Published : 2022-07-05 18:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-31117

Mitre link : CVE-2022-31117

CVE.ORG link : CVE-2022-31117

JSON object : View

Products Affected

fedoraproject

  • fedora

ultrajson_project

  • ultrajson
CWE
CWE-415

Double Free