python-jsonschema check-jsonschema up to 0.29.x acceptance of extraneous untrusted data with trusted data

Summaryinfo

A vulnerability has been found in python-jsonschema check-jsonschema up to 0.29.x and classified as problematic. The affected element is an unknown function. The manipulation leads to acceptance of extraneous untrusted data with trusted data. This vulnerability is uniquely identified as CVE-2024-53848. Local access is required to approach this attack. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in python-jsonschema check-jsonschema up to 0.29.x and classified as problematic. This issue affects an unknown part. The manipulation with an unknown input leads to a acceptance of extraneous untrusted data with trusted data vulnerability. Using CWE to declare the problem leads to CWE-349. The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted. Impacted is integrity. The summary by CVE is:

check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This naming allows for conflicts. If an attacker can get a user to run `check-jsonschema` against a malicious schema URL, e.g., `https://example.evil.org/schema.json`, they can insert their own schema into the cache and it will be picked up and used instead of the appropriate schema. Such a cache confusion attack could be used to allow data to pass validation which should have been rejected. This issue has been patched in version 0.30.0. All users are advised to upgrade. A few workarounds exist: 1. Users can use `--no-cache` to disable caching. 2. Users can use `--cache-filename` to select filenames for use in the cache, or to ensure that other usages do not overwrite the cached schema. (Note: this flag is being deprecated as part of the remediation effort.) 3. Users can explicitly download the schema before use as a local file, as in `curl -LOs https://example.org/schema.json; check-jsonschema --schemafile ./schema.json`

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-53848 since 11/22/2024. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.30.0 eliminates this vulnerability. Applying the patch c52714b85e6725b1b24516fbdedacb333b939152 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• python-jsonschema

Name

• check-jsonschema

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29

License

• open-source

Website

• Product: https://github.com/python-jsonschema/check-jsonschema/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion