Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect handling of invalid surrogate pair characters in ujson
Vulnerability Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
控制流实现总是不正确
Vulnerability Title
UltraJSON 安全漏洞
Vulnerability Description
UltraJSON是开源的一个超快的 JSON 编码器和解码器，用纯 C 语言编写，并绑定了 Python 3.7+。 UltraJSON 5.4.0之前版本存在安全漏洞，该漏洞源于无法正确解码某些字符，允许字典中潜在的键混淆和值覆盖。
CVSS Information
N/A
Vulnerability Type
N/A