DEBIAN-CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

bugbug (>=0.0.148, <=0.0.185), label-studio (0.4.1) potentially affected by CVE-2024-27454 via orjson (2.1.3)

orjson PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.148, =0.0.185 - label-studio 0.4.1 Source cves: CVE-2024-27454 Source advisory: OSV:PYSEC-2024-40...

bugbug (0.0.137) potentially affected by CVE-2024-27454 via orjson (2.1.0)

orjson PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug 0.0.137 Source cves: CVE-2024-27454 Source advisory: OSV:PYSEC-2024-40...

bugbug (>=0.0.128, <=0.0.136) potentially affected by CVE-2024-27454 via orjson (2.0.11)

orjson PYPI version 2.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.128, =0.0.136 Source cves: CVE-2024-27454 Source advisory: OSV:PYSEC-2024-40...

bitcoinrpc (>=0.2.1, <=0.2.2) potentially affected by CVE-2024-27454 via orjson (2.6.6)

orjson PYPI version 2.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bitcoinrpc =0.2.1, =0.2.2 Source cves: CVE-2024-27454 Source advisory: OSV:PYSEC-2024-40...

aioipfs (>=0.5.3, <=0.5.5), aioplemmy (>=0.3.2, <=0.3.3) +239 more potentially affected by CVE-2024-27454 via orjson (>=3.0.0, <=3.9.14)

orjson PYPI version =3.0.0, =0.5.3, =0.3.2, =0.13.14, =0.0.1, =2022.7.7, =0.1.1, =0.0.1, =0.0.1, =22.5.13, =4.1.0, =1.0.0, =0.3.2, =0.9.0, =0.1.0.dev5, =0.1.0.dev8 and more Source cves: CVE-2024-27454 Source advisory: OSV:PYSEC-2024-40...

Design/Logic Flaw

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

PYSEC-2024-40

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

CVE-2024-27454

The CVE-2024-27454 issue affects the orjson project: orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. Affected component is the orjson loader/parse path (orjson.loads) with potential recursion explosion. The vulnerability is reflected in CVSS 3.1 as HIGH impact to a...

CVE-2024-27454: Uncontrolled Recursion

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

orjson Security Vulnerabilities

orjson is a fast and correct Python JSON library for ijl individual developers. A security vulnerability exists in versions of orjson prior to 3.9.15, which stems from recursion in unrestricted deeply nested JSON documents...

CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

aioipfs (>=0.5.3, <=0.5.5), aioplemmy (>=0.3.2, <=0.3.3) +248 more potentially affected by CVE-2024-27454 via orjson (>=2.0.11, <=3.9.14)

orjson PYPI version =2.0.11, =0.5.3, =0.3.2, =0.13.14, =0.0.1, =2022.7.7, =0.1.1, =0.0.1, =0.0.1, =22.5.13, =4.1.0, =1.0.0, =0.3.2, =0.9.0, =0.1.5, =0.1.24 and more Source cves: CVE-2024-27454 Source advisory: MEND:CVE-2024-27454...

PT-2024-21907

Name of the Vulnerable Software and Affected Versions orjson versions prior to 3.9.15 Description The issue is related to the orjson.loads function in orjson, which does not limit recursion for deeply nested JSON documents. This can lead to potential exploitation. Recommendations For versions pri...