CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

bugbug (0.0.137) potentially affected by CVE-2024-27454 via orjson (2.1.0)

orjson PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug 0.0.137 Source cves: CVE-2024-27454 Source advisory: OSV:GHSA-PWR2-4V36-6QPR...

bugbug (>=0.0.143, <=0.0.147) potentially affected by CVE-2024-27454 via orjson (2.1.2)

orjson PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.143, =0.0.147 Source cves: CVE-2024-27454 Source advisory: OSV:GHSA-PWR2-4V36-6QPR...

aioipfs (>=0.5.3, <=0.5.5), aioplemmy (>=0.3.2, <=0.3.3) +239 more potentially affected by CVE-2024-27454 via orjson (>=3.0.0, <=3.9.14)

orjson PYPI version =3.0.0, =0.5.3, =0.3.2, =0.13.14, =0.0.1, =2022.7.7, =0.1.1, =0.0.1, =0.0.1, =22.5.13, =4.1.0, =1.0.0, =0.3.2, =0.9.0, =0.1.0.dev5, =0.1.0.dev8 and more Source cves: CVE-2024-27454 Source advisory: OSV:GHSA-PWR2-4V36-6QPR...

aioipfs (>=0.5.3, <=0.5.5), aioplemmy (>=0.3.2, <=0.3.3) +239 more potentially affected by CVE-2024-27454 via orjson (>=3.0.0, <=3.9.14)

orjson PYPI version =3.0.0, =0.5.3, =0.3.2, =0.13.14, =0.0.1, =2022.7.7, =0.1.1, =0.0.1, =0.0.1, =22.5.13, =4.1.0, =1.0.0, =0.3.2, =0.9.0, =0.1.0.dev5, =0.1.0.dev8 and more Source cves: CVE-2024-27454 Source advisory: GHSA-PWR2-4V36-6QPR...

CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

bugbug (>=0.0.148, <=0.0.185), label-studio (0.4.1) potentially affected by CVE-2024-27454 via orjson (2.1.3)

orjson PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.148, =0.0.185 - label-studio 0.4.1 Source cves: CVE-2024-27454 Source advisory: OSV:PYSEC-2024-40...

apologies (>=0.1.5, <=0.1.24), buvar (>=0.6.0, <=0.11.0) +5 more potentially affected by CVE-2024-27454 via orjson (2.6.8)

orjson PYPI version 2.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - apologies =0.1.5, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.2.6, =0.0.10, =0.0.12 Source cves: CVE-2024-27454 Source advisory: OSV:PYSEC-2024-40...

CVE-2024-27454 vulnerabilities

Vulnerabilities for packages: py3-orjson, kubeflow-pipelines-visualization-server...

bugbug (>=0.0.128, <=0.0.136) potentially affected by CVE-2024-27454 via orjson (2.0.11)

orjson PYPI version 2.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.128, =0.0.136 Source cves: CVE-2024-27454 Source advisory: OSV:PYSEC-2024-40...

CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

aioipfs (>=0.5.3, <=0.5.5), aioplemmy (>=0.3.2, <=0.3.3) +248 more potentially affected by CVE-2024-27454 via orjson (>=2.0.11, <=3.9.14)

orjson PYPI version =2.0.11, =0.5.3, =0.3.2, =0.13.14, =0.0.1, =2022.7.7, =0.1.1, =0.0.1, =0.0.1, =22.5.13, =4.1.0, =1.0.0, =0.3.2, =0.9.0, =0.1.5, =0.1.24 and more Source cves: CVE-2024-27454 Source advisory: MEND:CVE-2024-27454...

CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...