CVE-2021-45958: debian debian_linux Out-of-bounds Write
CVSS: 5.5v3.1MediumModified
AliasesMGASA-2022-0169SUSE-SU-2023:2134-1GHSA-fh56-85cw-5pq6PYSEC-2022-25UBUNTU-CVE-2021-45958USN-6629-2DEBIAN-CVE-2021-45958DLA-2929-1
Published 31-12-2021Last modified 04-08-2024
Vulnerability summary
CVE-2021-45958 is a medium (CVSS 5.5) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 1.55% chance of exploitation in the next 30 days, higher than 74.7% of scored vulnerabilities. 3 public exploits are recorded.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
1.55%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3github, reference
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 31-12-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
CVSS metrics
6 scores · 4 sources · 3 versionsMedium 6.8Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesSingle source
Medium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.55%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
0.00 pp
From 1.55% on 19-09-2026
19-09-202619-10-2026
EPSS score1.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundOss Fuzz Vulns
Maturity: poc
Ultrajson
Maturity: poc
Exploit Reference (bugs.chromium.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Suse3 products
- python-ujson&distro=SUSE Linux Enterprise Module for Development Tools 15 SP4< 1.35-150100.3.8.1
- python-ujson&distro=SUSE Linux Enterprise Module for Package Hub 15 SP4< 1.35-150100.3.8.1
- python-ujson&distro=SUSE Linux Enterprise Real Time 15 SP3< 1.35-150100.3.8.1
Debian2 products
- ujson< 5.2.0-1 | < 1.35-1+deb9u1
- debian_linuxEOL9.0
Ubuntu2 products
- pandasAll versions (No fix recorded)
- ujson< 1.33-1ubuntu0.1~esm2 | < 1.35-2ubuntu0.1~esm1 | < 1.35-4ubuntu0.1 | < 5.1.0-1ubuntu0.1~esm1
Fedoraproject1 product
- fedoraEOL35 | 36 | 37
Mageia1 product
- python-ujson< 5.2.0-1.mga8
Opensuse1 product
- python-ujson&distro=openSUSE Leap 15.4< 1.35-150100.3.8.1
PyPI1 product
- ujson≥ 1.34, < 5.2.0 | ≥ 4.0.2, < 5.1.0
Ultrajson_project1 product
- ultrajson< 5.2.0
8 vendors · 12 products
References
31 links- github.com/google/oss-fuzz-vulns/blob/main/vulns/ujson/OSV-2021-955.yamlX Refsource MISCWEBREPORTExploitThird Party Advisory
- bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009X Refsource MISCWEBREPORTExploitIssue TrackingThird Party Advisory
- github.com/ultrajson/ultrajson/issues/502X Refsource MISCWEBREPORTIssue TrackingPatchThird Party Advisory
- github.com/ultrajson/ultrajson/issues/501X Refsource MISCWEBREPORTExploitIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2022/02/msg00023.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
