CVE-2022-25024

Advisory

Json2xml 3.14.0 includes a fix for a Denial of Service vulnerability.
https://github.com/advisories/GHSA-8rj5-2857-877j

Affected package

Affected versions

Fixed versions

Vulnerability changelog

The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service. See CVE-2022-25024.


MISC:https://github.com/vinitkumar/json2xml/issues/106: https://github.com/vinitkumar/json2xml/issues/106
MISC:https://github.com/vinitkumar/json2xml/pull/107: https://github.com/vinitkumar/json2xml/pull/107
MISC:https://github.com/vinitkumar/json2xml/pull/107/files: https://github.com/vinitkumar/json2xml/pull/107/files
MISC:https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads/: https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads/

Resources

• https://github.com/vinitkumar/json2xml/issues/106
• https://github.com/vinitkumar/json2xml/pull/107
• https://github.com/vinitkumar/json2xml/pull/107/files
• https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25024