PT-2010-3326 · Unknown · Python-Cjson

Matt Giuca + 1 · Published 2010-07-02 · Updated 2022-05-17 · CVE-2010-1666

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions python-cjson version 1.0.5

Description The issue is related to a buffer overflow that occurs when UCS-4 encoding is enabled. This allows attackers to cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts. The attack vectors involve crafted Unicode input to the cjson.encode function.

Recommendations For python-cjson version 1.0.5, consider disabling UCS-4 encoding as a temporary workaround to minimize the risk of exploitation. Avoid using the cjson.encode function with crafted Unicode input until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-1666

DSA-2068-1

GHSA-CQMH-MPX2-G633

PYSEC-2010-30

Affected Products

Python-Cjson

References · 12

• http://secunia.com/advisories/40335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1666 · Security Note
• http://debian.org/security/2010/dsa-2068 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cqmh-mpx2-g633 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2010-30 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/python-cjson/PYSEC-2010-30.yaml · Note
• https://github.com/AGProjects/python-cjson/commit/dc2b8781b8666de5ca707318521f554904fdd690 · Note
• https://github.com/AGProjects/python-cjson · Note
• http://secunia.com/advisories/40500 · Note
• https://github.com/advisories/GHSA-cqmh-mpx2-g633 · Note
• http://vupen.com/english/advisories/2010/1774 · Note
• https://bugs.launchpad.net/ubuntu/+source/python-cjson/+bug/585274 · Note