--===============7103077811235415487==
Content-Type: text/plain; charset="utf-8"

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 202403-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal
    Title: UltraJSON: Multiple Vulnerabilities
     Date: March 03, 2024
     Bugs: #855689
       ID: 202403-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been discovered in UltraJSON, the worst of
which could lead to key confusion and value overwriting.

Background
==========

UltraJSON is an ultra fast JSON encoder and decoder written in pure C
with bindings for Python 3.8+.

Affected packages
=================

Package           Vulnerable    Unaffected
----------------  ------------  ------------
dev-python/ujson  < 5.4.0       >= 5.4.0

Description
===========

Affected versions were found to improperly decode certain characters.
JSON strings that contain escaped surrogate characters not part of a
proper surrogate pair were decoded incorrectly. Besides corrupting
strings, this allowed for potential key confusion and value overwriting
in dictionaries. All users parsing JSON from untrusted sources are
vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the
same way as the standard library's `json` module does, preserving them
in the parsed output.

Impact
======

Please review the referenced CVE identifiers for details.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All UltraJSON users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=dev-python/ujson-5.4.0"

References
==========

[ 1 ] CVE-2022-31116
      https://nvd.nist.gov/vuln/detail/CVE-2022-31116
[ 2 ] CVE-2022-31117
      https://nvd.nist.gov/vuln/detail/CVE-2022-31117

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202403-03

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5
--===============7103077811235415487==
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmXkVH8ACgkQFMQkOaVy
+9ksUxAAlK3TNZa3l3/9Czoc2jQMUvN/kwRu+7+dumdmxy//9Mm5bapILTgYnt61
5DZzCuJZmeEZPZNtUlEdsqcoEOZ1Yq0h0VBlB69AkFrZPgZ7eNN2VIGzOSPjMcsM
XobMl14ozUtIYL4yyyA15KFkGBbZnTuzJ7o1pzoEQmB6WyVhG758tYCpQkSI0D63
aZF3WuZBDdSCk9DTRPPADFESS8qPgvWl0L4Xgfw4a6mVEshDevYLWnrlQ8kHPKE3
PPJYwTXWhFbXj0WzGxum3dHzRErD05CwA3KnsuwhPre+U3OXEaxAKZ1dc2ee11O0
0iPO7MnmOShW7LvBRNu4RvUsG4Z54MgX2vXVi1TZgBW+KEb2bPwQsuKwU5wr50Zw
rQ9Nqj4v15DRC3SshsxdNmnLWY3Xn0WOcjMkkOT+++e4R0vqF3Ketand3EnTSKQK
4eT+8pXqRgyY+oSoabb0jHcSHnFl1PdJCx3revDrWwtqk6dJeiadiM0YLMD2FBe9
2MLgLmnpVUk51EBhwnwG66yHn0S2M/4VNmdhTYjn3VacAxkfFurS0nhHsIXJGndd
217Tp0KDoB9kVH/gDL0dUMeuVmBYaJllyS0URaPJm4TI/x1IGPU29IuHm7ElUias
kph2ptTVplh0z4mlRCsiQNjbUVZv4M+y6k0gkL659CvlO2z4jCc=
=c6CG
-----END PGP SIGNATURE-----

--===============7103077811235415487==--