CVE-2024-27454: High severity Ijl Orjson Python vulnerability
Published Feb 26, 2024
·Updated
orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.
Affected Software
2 affected componentsFixes available
pip/orjson<3.9.15
3.9.15
Ijl Orjson Python<3.9.15
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/orjsonto a version that resolves this vulnerability.Fixed in 3.9.15
Event History
Feb 26, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverity
Data Sourced
via NVD·04:28 PM
DescriptionSeverity
Data Sourced
via NVD·04:28 PM
RemedyWeaknessAffected Software
Advisory Published
via GitHub·06:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-27454?
CVE-2024-27454 is categorized as a medium severity vulnerability due to the potential for denial of service from excessive recursion in parsing JSON.
2
How do I fix CVE-2024-27454?
To fix CVE-2024-27454, upgrade the orjson package to version 3.9.15 or later.
3
What kind of attack can CVE-2024-27454 enable?
CVE-2024-27454 can enable denial of service attacks by allowing deeply nested JSON documents to cause stack overflows.
4
Which versions of orjson are affected by CVE-2024-27454?
CVE-2024-27454 affects all versions of orjson prior to 3.9.15.
5
Is CVE-2024-27454 exploitable in production environments?
Yes, CVE-2024-27454 can be exploited in production environments where deeply nested JSON documents are processed.