Alerts This Week
Warning Icon 1 684
Alerts This Week
Warning Icon 1 684

Fedora 25: FEDORA-2017-7803508155 critical: python-cjson denial of service

fedora
Calendar Grey February 26, 2017
Dist Fedora Esm H88
The recent enhancement for python-cjson in Fedora 25 addresses a vulnerability that could lead to a denial of service via crashes when handling deeply nested JSON data.
This update prevents `python-cjson` from crashing when attempting to parse heavily nested JSON structures (which could be exploited for denial of service purposes, against any appl...

Summary

This module implements a very fast JSON encoder/decoder for Python.

JSON stands for JavaScript Object Notation and is a text based lightweight

data exchange format which is easy for humans to read/write and for machines

to parse/generate. JSON is completely language independent and has multiple

implementations in most of the programming languages, making it ideal for

data exchange and storage.

The module is written in C and it is up to 250 times faster when compared to

the other python JSON implementations which are written directly in python.

This speed gain varies with the complexity of the data and the operation and

is the the range of 10-200 times for encoding operations and in the range of

100-250 times for decoding operations.

Update Information:

This update prevents `python-cjson` from crashing when attempting to parse heavily nested JSON structures (which could be exploited for denial of service purposes, against any application that uses `python-cjson` to parse arbitrary input).

Topics%20covered

Topics Covered

security advisory Fedora DoS update information crash prevention python-cjson

Change Log

References

Fedora Update Notification FEDORA-2017-7803508155 2017-02-25 19:18:00.756223
Name : python-cjson Product : Fedora 25 Version : 1.1.0 Release : 9.fc25 URL : https://pypi.org/project/python-cjson/ Summary : Fast JSON encoder/decoder for Python Description : This module implements a very fast JSON encoder/decoder for Python.
JSON stands for JavaScript Object Notation and is a text based lightweight data exchange format which is easy for humans to read/write and for machines to parse/generate. JSON is completely language independent and has multiple implementations in most of the programming languages, making it ideal for data exchange and storage.
The module is written in C and it is up to 250 times faster when compared to the other python JSON implementations which are written directly in python. This speed gain varies with the complexity of the data and the operation and is the the range of 10-200 times for encoding operations and in the range of 100-250 times for decoding operations.

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade python-cjson' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html

Severity
critical
Lowest
Low
Medium
High
Critical

Name: python-cjson
Product: Fedora 25
Version: 1.1.0
Release: 9.fc25
URL: https://pypi.org/project/python-cjson/
Summary: Fast JSON encoder/decoder for Python

Topics%20covered

Topics Covered

security advisory Fedora DoS update information crash prevention python-cjson

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here