PT-2023-12774 · Json2Xml · Json2Xml

Asteriska001 · Publicado 2023-08-22 · Atualizado 2023-08-25 · CVE-2022-25024

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions json2xml versions through 3.12.0

Description The issue allows an error in typecode decoding, enabling a remote attack that can lead to an exception, causing a denial of service.

Recommendations For versions through 3.12.0, consider updating to a version that fixes the typecode decoding error to prevent remote attacks leading to a denial of service.

Exploit

Correção

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-754

CWE-248

Identificadores relacionados

CVE-2022-25024

GHSA-8RJ5-2857-877J

PYSEC-2023-149

Produtos afetados

Json2Xml

Referências · 11

• 🔥 https://github.com/vinitkumar/json2xml/issues/106 · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/json2xml/PYSEC-2023-149.yaml · Nota
• https://github.com/vinitkumar/json2xml/pull/107/files · Correção
• https://github.com/vinitkumar/json2xml/pull/107 · Correção
• https://github.com/vinitkumar/json2xml/commit/a9cd75b61329801b47a8fba7473bce6c85a38b9b · Nota
• https://github.com/vinitkumar/json2xml · Nota
• https://osv.dev/vulnerability/CVE-2022-25024 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-25024 · Nota de Segurança
• https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads · Nota
• https://osv.dev/vulnerability/GHSA-8rj5-2857-877j · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-149 · Aviso do Fabricante