PT-2022-37586 · Ultrajson · Ultrajson

Published 2022-12-30 · Updated 2022-12-30

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions ultrajson (affected versions not specified)

Description The issue concerns an integer overflow related to the len function. Additionally, there was a problem with ultrajson building on webassembly (e.g., pyodide) due to an outdated version of double-conversion, which has been updated to support webassembly.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2022-0487

Affected Products

Ultrajson

References · 5

• https://osv.dev/vulnerability/MGASA-2022-0487 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0487.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MJ66UZLJXIEOD5Q74IZKQQRWAPPFG6T7 · Vendor Advisory
• https://github.com/ultrajson/ultrajson/pull/570 · Note
• https://bugs.mageia.org/show_bug.cgi?id=31332 · Note