Security readout for executives and security teams
Plain-English summary
UltraJSON before 5.4.0 has a memory-management flaw that could crash the decoder under a specific error condition. The advisory states this cannot be triggered from Python, which significantly lowers practical urgency for normal Python applications. The recommended action is still to upgrade because no workaround is provided.
Executive priority
Schedule remediation through normal dependency update cycles, faster for externally exposed services with confirmed vulnerable packages. This is not supported as an emergency issue by the provided evidence, but leaving vulnerable native-code libraries unpatched increases operational risk.
Technical view
CVE-2022-31117 is a CWE-415 double free in UltraJSON string decoding before 5.4.0, occurring when buffer reallocation fails. CVSS 3.1 is 5.9 with high availability impact and high attack complexity. The vendor advisory says UltraJSON’s internal decoder makes the issue impossible to trigger from Python.
Likely exposure
Exposure is limited to systems bundling ultrajson/ujson versions before 5.4.0. Ordinary Python use appears less exposed because the source bundle says the condition cannot be triggered from Python. Fedora advisories indicate downstream packages were updated, so Linux package provenance should also be checked.
Exploitation context
The bundle does not show active exploitation, KEV listing, public exploit status, or real-world incidents. Exploitability is constrained by high complexity and the vendor statement that Python-triggering is impossible. Treat this mainly as dependency hygiene unless vendor-specific guidance says otherwise.
Researcher notes
Focus validation on version presence and package provenance, not exploit reproduction. The key technical constraint is the vendor claim that Python cannot trigger the double free. Evidence does not define another reachable trigger path, so avoid assuming broader exploitability.
Mitigation direction
- Upgrade UltraJSON/ujson to version 5.4.0 or later.
- Update affected operating-system packages from the relevant distribution repositories.
- Check vendor guidance because the advisory states there are no known workarounds.
- Prioritize internet-facing services only after confirming they actually use affected versions.
Validation and detection
- Inventory application dependencies, lockfiles, containers, and SBOMs for ultrajson or ujson below 5.4.0.
- Confirm runtime environments load UltraJSON 5.4.0 or later.
- Review distribution package versions where UltraJSON is installed through Fedora or system packages.
- Record that normal Python triggerability is not supported by the cited advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-415: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-31117 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H2.23.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ffCVE reference · x_refsource_CONFIRM
- https://github.com/ultrajson/ultrajson/commit/9c20de0f77b391093967e25d01fb48671104b15bCVE reference · x_refsource_MISC
- FEDORA-2022-1b2b8d5177CVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-33e816bc37CVE reference · vendor-advisory, x_refsource_FEDORA
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.