Debian alert DLA-2929-1 (ujson)

From:
             
 
Anton Gladky <gladk@debian.org>
To:
             
 
<debian-lts-announce@lists.debian.org>
Subject:
             
 
[SECURITY] [DLA 2929-1] ujson security update
Date:
             
 
Sat, 26 Feb 2022 23:19:49 +0100
Message-ID:
             
 
<20220226221949.EC6EF4A0144@thinkpad.localdomain>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2929-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                         Anton Gladky
February 26, 2022                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : ujson
Version        : 1.35-1+deb9u1
CVE ID         : CVE-2021-45958

One issue have been discovered in ujson: ultra fast JSON encoder and decoder for Python.

CVE-2021-45958

    Stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode) has
    been detected. Exploitation can, for example, use a large amount of indentation.


For Debian 9 stretch, this problem has been fixed in version
1.35-1+deb9u1.

We recommend that you upgrade your ujson packages.

For the detailed security status of ujson please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ujson

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAmIap3wACgkQ0+Fzg8+n
/wasXg//bRnI92gxS/+jf275UkyR6Ivjhlsm2griSV+nCbBM4F2pal8j3O55S0gA
KsKfqEbk8q+IrvWzoG6nRTTn2yNK+Ln5hQUb1tpWbNbh3gXFHybZ7M1bffJiZxIJ
RkW8JrHWaTAIquhi7esKo/mgSJc9M9dxHGZj2HaeRBAo1LZwPgMQjoRmGsm017U3
ZwBmTPwwKal0fFwzploQ2op7dgKMZ1iq0dYJgrWyxD0xGuYcVKBPenP5FR/MpG6q
bMDYtFKTRHgdFtZZ+ayzJlKvM6HN3bUgxKI3WiyfBKXqV5/X+qkEhPw3qEhd1HZi
m9ElhZOUrGgTpE16IQd7Jn28KuiYGPaXCqDMZgC1D05DkVvCbEVBtlapXupL93Hz
//WQ0ZfAzlimNlIb6M3cca3w1UDUWCHYBSQrzDc47p+O4y9ayqE5dDMMG630Lyef
EHV6EpII2sXgqw1p6+qjaW9s8kRN7DSho142ZIkd/IMwhL4dpMui/XILUDA1Y3Dv
UB9/xPvRnEPVmIinONvw0tJKjlbzuASfvM+4SmN9r5M26YDzdC/fwV3JFmExespE
A5wEdyW4ePyc4c4IVAYqiF0bBa0QUoO2dj+zcPUPif8kiA10gX/j7k2SLjIE2moF
wYyQ0Jv640ZXyySYBi7ObECOwaUnrxxiFCegyMf2sm1hwCQiKhM=
=xfNX
-----END PGP SIGNATURE-----