PT-2023-12774 · Json2Xml · Json2Xml

Asteriska001 · Published 2023-08-22 · Updated 2023-08-25 · CVE-2022-25024

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions json2xml versions through 3.12.0

Description The issue allows an error in typecode decoding, enabling a remote attack that can lead to an exception, causing a denial of service.

Recommendations For versions through 3.12.0, consider updating to a version that fixes the typecode decoding error to prevent remote attacks leading to a denial of service.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-248

Related Identifiers

CVE-2022-25024

GHSA-8RJ5-2857-877J

PYSEC-2023-149

Affected Products

Json2Xml

References · 11

• 🔥 https://github.com/vinitkumar/json2xml/issues/106 · Exploit
• https://github.com/vinitkumar/json2xml/pull/107/files · Patch
• https://github.com/vinitkumar/json2xml/pull/107 · Patch
• https://osv.dev/vulnerability/CVE-2022-25024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25024 · Security Note
• https://osv.dev/vulnerability/GHSA-8rj5-2857-877j · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-149 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/json2xml/PYSEC-2023-149.yaml · Note
• https://github.com/vinitkumar/json2xml/commit/a9cd75b61329801b47a8fba7473bce6c85a38b9b · Note
• https://github.com/vinitkumar/json2xml · Note
• https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads · Note