FEDORA-2022-1b2b8d5177 — security update for python-ujson

stable

python-ujson-5.4.0-1.fc36

FEDORA-2022-1b2b8d5177 created by music 2 years ago for Fedora 36

Security fix for CVE-2022-31116 and CVE-2022-31117.

5.4.0

Added

Add support for arbitrary size integers

Fixed

CVE-2022-31116: Replace wchar_t string decoding implementation with a uint32_t-based one; fix handling of surrogates on decoding
CVE-2022-31117: Potential double free of buffer during string decoding
Fix memory leak on encoding errors when the buffer was resized
Integer parsing: always detect overflows
Fix handling of surrogates on encoding

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2022-1b2b8d5177

This update has been submitted for testing by music.

2 years ago

This update's test gating status has been changed to 'ignored'.

2 years ago

music edited this update.

2 years ago

This update has been pushed to testing.

2 years ago

This update has been submitted for stable by bodhi.

2 years ago

This update has been pushed to stable.

2 years ago

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

2 years ago

in testing

2 years ago

in stable

2 years ago

modified

2 years ago

Builds

python-ujson-5.4.0-1.fc36

BZ#2103379 python-ujson-5.4.0 is available

BZ#2104739 CVE-2022-31117 python-ujson: Potential double free of buffer during string decoding

BZ#2104740 CVE-2022-31116 python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting

BZ#2106986 CVE-2022-31117 python-ujson: Potential double free of buffer during string decoding [fedora-all]

BZ#2106990 CVE-2022-31116 python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting [fedora-all]

python-ujson-5.4.0-1.fc36

Automated Test Results

ignored