OPENSUSE-SU-2024:13735-1 python310-orjson-3.9.15-1.1 on GA media

These are all security issues fixed in the python310-orjson-3.9.15-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

Denial Of Service (DoS)

orjson is vulnerable to Denial Of Service. The vulnerability is due to the lack of recursion depth limits during parsing, which allows attackers to potentially cause denial of service by supplying deeply nested JSON documents...

GHSA-PWR2-4V36-6QPR vulnerabilities

Vulnerabilities for packages: py3-orjson, kubeflow-pipelines-visualization-server...

orjson does not limit recursion for deeply nested JSON documents

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

GHSA-PWR2-4V36-6QPR orjson does not limit recursion for deeply nested JSON documents

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

01os (>=0.0.5 <=0.0.13), 10xscale-agentflow-cli (>=0.1.5 <=0.3.2.9) +17157 more potentially affected by CVE-2024-27454 via orjson (>=2.0.11 <=3.9.14)

orjson PYPI version =2.0.11, =0.0.5, =0.1.5, =0.1.0, =0.2.2, =0.1.0, =0.1.1001, =0.1.3, =3.0.1, =0.1.0, =0.1.0, =0.2.6 and more Source cves: CVE-2024-27454 Source advisory: OSV:GHSA-PWR2-4V36-6QPR...

GHSA-PWR2-4V36-6QPR vulnerabilities

Vulnerabilities for packages: py3-orjson, kubeflow-pipelines-visualization-server...

Design/Logic Flaw

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

PYSEC-2024-40

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

01os (>=0.0.5 <=0.0.13), 10xscale-agentflow-cli (>=0.1.5 <=0.3.2.9) +17157 more potentially affected by CVE-2024-27454 via orjson (>=2.0.11 <=3.9.14)

orjson PYPI version =2.0.11, =0.0.5, =0.1.5, =0.1.0, =0.2.2, =0.1.0, =0.1.1001, =0.1.3, =3.0.1, =0.1.0, =0.1.0, =0.2.6 and more Source cves: CVE-2024-27454 Source advisory: OSV:PYSEC-2024-40...

DEBIAN-CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

PYSEC-2024-40

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

CVE-2024-27454 vulnerabilities

Vulnerabilities for packages: py3-orjson, kubeflow-pipelines-visualization-server...

CVE-2024-27454 vulnerabilities

Vulnerabilities for packages: py3-orjson, kubeflow-pipelines-visualization-server...

CVE-2024-27454

The CVE-2024-27454 issue affects the orjson project: orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. Affected component is the orjson loader/parse path (orjson.loads) with potential recursion explosion. The vulnerability is reflected in CVSS 3.1 as HIGH impact to a...

CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

orjson Security Vulnerabilities

orjson is a fast and correct Python JSON library for ijl individual developers. A security vulnerability exists in versions of orjson prior to 3.9.15, which stems from recursion in unrestricted deeply nested JSON documents...

PT-2024-21907 · Orjson · Orjson

Name of the Vulnerable Software and Affected Versions: orjson versions prior to 3.9.15 Description: The issue is related to the orjson.loads function in orjson, which does not limit recursion for deeply nested JSON documents. This can lead to potential exploitation. Recommendations: For versions...