p PatchFirst

CVE-2021-45958

CVE-2021-45958

This page contains facts from public vulnerability sources. Check the original advisory before updating.

UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.

CVSS 6.8 · Medium · EPSS 1.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • ujson Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.2.0-1

    Update to 5.2.0-1

  • ujson Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.2.0-1

    Update to 5.2.0-1

  • ujson Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.2.0-1

    Update to 5.2.0-1

  • ujson PyPI

    Versions
    • 1.34
    • 1.35
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 3.0.0
    • 3.1.0
    • 3.2.0
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 5.0.0
    • 5.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.34, < 5.2.0

    Update to 5.2.0

  • ujson PyPI

    Versions
    • 4.0.2
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 5.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.2, < 5.1.0

    Update to 5.1.0

  • pandas Ubuntu:14.04:LTS

    Versions
    • 0.12.0-2ubuntu1
    • 0.13.1-2ubuntu1
    • 0.13.1-2ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ujson Ubuntu:Pro:16.04:LTS

    Versions
    • 1.33-1
    • 1.33-1build1
    Affected ranges
    • ECOSYSTEM: < 1.33-1ubuntu0.1~esm2

    Update to 1.33-1ubuntu0.1~esm2

  • pandas Ubuntu:16.04:LTS

    Versions
    • 0.15.0-2
    • 0.15.0-2ubuntu1
    • 0.15.0-2ubuntu2
    • 0.17.1-3ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pandas Ubuntu:18.04:LTS

    Versions
    • 0.19.2-5.1ubuntu4
    • 0.22.0-2ubuntu1
    • 0.22.0-3
    • 0.22.0-4
    • 0.22.0-4ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ujson Ubuntu:Pro:18.04:LTS

    Versions
    • 1.35-1build2
    • 1.35-2
    Affected ranges
    • ECOSYSTEM: < 1.35-2ubuntu0.1~esm1

    Update to 1.35-2ubuntu0.1~esm1

  • ujson Ubuntu:20.04:LTS

    Versions
    • 1.35-3build1
    • 1.35-3build2
    • 1.35-4
    • 1.35-4build1
    Affected ranges
    • ECOSYSTEM: < 1.35-4ubuntu0.1

    Update to 1.35-4ubuntu0.1

  • pandas Ubuntu:20.04:LTS

    Versions
    • 0.23.3+dfsg-4ubuntu1
    • 0.23.3+dfsg-4ubuntu5
    • 0.23.3+dfsg-4ubuntu6
    • 0.25.3+dfsg-4
    • 0.25.3+dfsg-4build1
    • 0.25.3+dfsg-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pandas Ubuntu:22.04:LTS

    Versions
    • 1.1.5+dfsg-2
    • 1.1.5+dfsg-2ubuntu1
    • 1.3.5+dfsg-2
    • 1.3.5+dfsg-2ubuntu1
    • 1.3.5+dfsg-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ujson Ubuntu:Pro:22.04:LTS

    Versions
    • 4.0.2-1
    • 4.0.2-1build1
    • 4.2.0-1
    • 5.1.0-1
    • 5.1.0-1build1
    Affected ranges
    • ECOSYSTEM: < 5.1.0-1ubuntu0.1~esm1

    Update to 5.1.0-1ubuntu0.1~esm1

  • pandas Ubuntu:24.04:LTS

    Versions
    • 1.5.3+dfsg-6
    • 1.5.3+dfsg-6ubuntu1
    • 1.5.3+dfsg-7ubuntu1
    • 1.5.3+dfsg-10
    • 2.1.4+dfsg-4ubuntu2
    • 2.1.4+dfsg-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pandas Ubuntu:25.10

    Versions
    • 2.2.3+dfsg-8build1
    • 2.2.3+dfsg-9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pandas Ubuntu:26.10

    Versions
    • 2.3.3+dfsg-3ubuntu1
    • 2.3.3+dfsg-3ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pandas Ubuntu:26.04:LTS

    Versions
    • 2.2.3+dfsg-9
    • 2.3.3+dfsg-1ubuntu1
    • 2.3.3+dfsg-3
    • 2.3.3+dfsg-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →