[Security] remove ujson package (CVE-2022-31116, CVE-2022-31117, CVE-2021-45958) - #1676
Open
PatStLouis wants to merge 5 commits into
Open
Conversation
Signed-off-by: pstlouis <patrick.st-louis@opsecid.ca>
Contributor
|
@PatStLouis, Please rebase this PR now that your fix for the failed action has been merged. Thanks |
|
@PatStLouis Here is the some notes for remediation process. |
Contributor
Author
|
@crajapakshe pysha3 is a separate package, and we won't likely be able to update this package in a timely manner as there is some breaking changes introduced in >=1.0. Current installations use version |
Signed-off-by: pstlouis <patrick.st-louis@opsecid.ca>
PatStLouis
changed the title
Signed-off-by: pstlouis <patrick.st-louis@opsecid.ca>
kukgini
added a commit
to kukgini/indy-plenum
that referenced
this pull request
Jul 2, 2026
Fixes layered on top of hyperledger-indy#1676's ujson removal (CVE-2022-31116, CVE-2022-31117, CVE-2021-45958): - channel.py: the lint fix in hyperledger-indy#1676 replaced `type(msg) != tuple` with `not isinstance(type(msg), tuple)`, which is always True and wrapped already-tuple messages into nested tuples, breaking handler routing. Restore the original semantics in a lint-clean form (`type(msg) is not tuple`), preserving NamedTuple wrapping. - zstack serializeMsg: ujson emitted compact JSON; stdlib json's default separators add whitespace, growing every wire message and breaking the exact-size assertions in stp_zmq/test/test_zstack.py calibrated to MSG_LEN_LIMIT. Pass separators=(',', ':') to keep the wire format byte-compatible. (Applied to scripts/test_zmq's copy as well.) - recorder: SimpleZStackWithRecorder records raw wire frames; ujson silently encoded bytes as UTF-8 strings while stdlib json raises TypeError, so recording mode (STACK_COMPANION=1) crashed on the first message. Add a bytes-decoding default hook and a bytes regression test. - Add regression tests pinning JsonSerializer's exact byte output (key ordering, compact separators, raw-UTF-8 non-ASCII, float repr, int-key coercion, top-level-bytes base64) since it feeds signing/hashing, plus characterisation of the nested-bytes TypeError. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: kukgini <kukgini@gmail.com>
kukgini
added a commit
to kukgini/indy-plenum
that referenced
this pull request
Jul 2, 2026
Fixes layered on top of hyperledger-indy#1676's ujson removal. Dropping the dependency resolves the four ujson CVEs affecting the previously pinned 1.33 (CVE-2022-31116, CVE-2022-31117, CVE-2026-44660, CVE-2026-54911; CVE-2021-45958 cited in hyperledger-indy#1676 only affects ujson >= 1.34). - channel.py: the lint fix in hyperledger-indy#1676 replaced `type(msg) != tuple` with `not isinstance(type(msg), tuple)`, which is always True and wrapped already-tuple messages into nested tuples, breaking handler routing. Restore the original semantics in a lint-clean form (`type(msg) is not tuple`), preserving NamedTuple wrapping. - zstack serializeMsg: ujson emitted compact JSON; stdlib json's default separators add whitespace, growing every wire message and breaking the exact-size assertions in stp_zmq/test/test_zstack.py calibrated to MSG_LEN_LIMIT. Pass separators=(',', ':') to keep the wire format byte-compatible. (Applied to scripts/test_zmq's copy as well.) - recorder: SimpleZStackWithRecorder records raw wire frames; ujson silently encoded bytes as UTF-8 strings while stdlib json raises TypeError, so recording mode (STACK_COMPANION=1) crashed on the first message. Add a bytes-decoding default hook and a bytes regression test. - Add regression tests pinning JsonSerializer's exact byte output (key ordering, compact separators, raw-UTF-8 non-ASCII, float repr, int-key coercion, top-level-bytes base64) since it feeds signing/hashing, plus characterisation of the nested-bytes TypeError. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: kukgini <kukgini@gmail.com>
kukgini
added a commit
to kukgini/indy-plenum
that referenced
this pull request
Jul 2, 2026
Fixes layered on top of hyperledger-indy#1676's ujson removal. Dropping the dependency resolves the four ujson CVEs affecting the previously pinned 1.33 (CVE-2022-31116, CVE-2022-31117, CVE-2026-44660, CVE-2026-54911; CVE-2021-45958 cited in hyperledger-indy#1676 only affects ujson >= 1.34). - channel.py: the lint fix in hyperledger-indy#1676 replaced `type(msg) != tuple` with `not isinstance(type(msg), tuple)`, which is always True and wrapped already-tuple messages into nested tuples, breaking handler routing. Restore the original semantics in a lint-clean form (`type(msg) is not tuple`), preserving NamedTuple wrapping. - zstack serializeMsg: ujson emitted compact JSON; stdlib json's default separators add whitespace, growing every wire message and breaking the exact-size assertions in stp_zmq/test/test_zstack.py calibrated to MSG_LEN_LIMIT. Pass separators=(',', ':') to keep the wire format byte-compatible. (Applied to scripts/test_zmq's copy as well.) - recorder: SimpleZStackWithRecorder records raw wire frames; ujson silently encoded bytes as UTF-8 strings while stdlib json raises TypeError, so recording mode (STACK_COMPANION=1) crashed on the first message. Add a shared bytes-decoding default hook (plenum.common.util.json_default_bytes_to_str) and a bytes regression test. - Add regression tests pinning JsonSerializer's exact byte output (key ordering, compact separators, raw-UTF-8 non-ASCII, float repr, int-key coercion, top-level-bytes base64) since it feeds signing/hashing, plus characterisation of the nested-bytes TypeError. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: kukgini <kukgini@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://security.snyk.io/package/pip/ujson