PT-2010-3326 · Unknown · Python-Cjson

Matt Giuca + 1 · Publicado 2010-07-02 · Atualizado 2022-05-17 · CVE-2010-1666

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions python-cjson version 1.0.5

Description The issue is related to a buffer overflow that occurs when UCS-4 encoding is enabled. This allows attackers to cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts. The attack vectors involve crafted Unicode input to the cjson.encode function.

Recommendations For python-cjson version 1.0.5, consider disabling UCS-4 encoding as a temporary workaround to minimize the risk of exploitation. Avoid using the cjson.encode function with crafted Unicode input until the issue is resolved.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-1666

DSA-2068-1

GHSA-CQMH-MPX2-G633

PYSEC-2010-30

Produtos afetados

Python-Cjson

Referências · 12

• https://github.com/pypa/advisory-database/tree/main/vulns/python-cjson/PYSEC-2010-30.yaml · Nota
• https://github.com/AGProjects/python-cjson/commit/dc2b8781b8666de5ca707318521f554904fdd690 · Nota
• https://github.com/AGProjects/python-cjson · Nota
• http://secunia.com/advisories/40335 · Aviso do Fabricante
• http://secunia.com/advisories/40500 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1666 · Nota de Segurança
• https://github.com/advisories/GHSA-cqmh-mpx2-g633 · Nota
• http://debian.org/security/2010/dsa-2068 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-cqmh-mpx2-g633 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1774 · Nota
• https://bugs.launchpad.net/ubuntu/+source/python-cjson/+bug/585274 · Nota
• https://osv.dev/vulnerability/PYSEC-2010-30 · Aviso do Fabricante