CVE-2022-25024

Python json2xml package (up to v3.12.0) remote attack, denial of service, typecode decoding error

• CVSS 7.5
• CWE-754 Improper Check for Unusual or Exceptional Conditions
• Cryptographic
• Remote

The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.

CVE

CVE-2022-25024

CWE

CWE-754 Improper Check for Unusual or Exceptional Conditions

CVSS base score

7.5

Published

2023-08-22

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update json2xml package to version 3.13.0 or higher.

from json2xml import json2xml

def json2xml(json_input):
    xml_output = json2xml.Json2xml(json=json_input).to_xml()
    return xml_output

json_input = '{"key": "value"}'
xml_output = json2xml(json_input)
print(xml_output)

import json
from json2xml import json2xml

def json2xml(json_input):
    try:
        json_data = json.loads(json_input)
        xml_output = json2xml.Json2xml(json=json_data).to_xml()
        return xml_output
    except (json.JSONDecodeError, TypeError) as e:
        return f"Error processing input: {e}"

json_input = '{"key": "value"}'
xml_output = json2xml(json_input)
print(xml_output)

@misc{vaitp:cve202225024,
  title        = {{Python json2xml package (up to v3.12.0) remote attack, denial of service, typecode decoding error}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-25024},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-25024/}}
}