Executive Summary

The vulnerability exists in UltraJSON, a fast JSON encoder and decoder written in pure C with Python bindings. Before version 5.13.0, the functions ujson.dumps(), ujson.dump(), and ujson.encode() had an option reject_bytes=False that could accept malformed or truncated UTF-8 byte sequences. Instead of rejecting these invalid sequences, the functions would silently rewrite them into different Unicode characters. This behavior leads to input validation bypass and data integrity issues.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing malformed or truncated UTF-8 byte sequences to be accepted and silently altered rather than rejected. This can cause input validation bypass, meaning that invalid or malicious data might be processed without detection. Additionally, it can lead to data integrity issues because the original data may be changed unexpectedly during encoding or decoding.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade UltraJSON (ujson) to version 5.13.0 or later, where the issue with malformed or truncated UTF-8 byte sequences being silently rewritten is fixed.

Useful 0 Not Useful 0