From 8f692d885f06287d00faf713bcbf23619813bd9b Mon Sep 17 00:00:00 2001 From: Zedifus Date: Sat, 6 Apr 2024 22:32:14 +0100 Subject: [PATCH 1/4] Bump orjson for CVE-2024-27454 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index e3a58bad..ed0f7698 100644 --- a/requirements.txt +++ b/requirements.txt @@ -18,5 +18,5 @@ termcolor==1.1 tornado==6.3.3 tzlocal==5.1 jsonschema==4.19.1 -orjson==3.9.7 +orjson==3.9.15 prometheus-client==0.17.1 From ff20705f32e77f4212fcc4783901b2226b69ccd5 Mon Sep 17 00:00:00 2001 From: Zedifus Date: Sat, 6 Apr 2024 22:35:10 +0100 Subject: [PATCH 2/4] Update changelog !747 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 74695a9c..66b9b363 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ TBD - Fix migrator issue when jumping versions ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/734)) - Fix backend issue causing error when restoring backups in 4.3.x ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/736)) - Fix backend issue causing error when cloning servers in 4.3.x ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/741)) +- Bump orjson for CVE-2024-27454 ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/747)) ### Tweaks - Clean up remaining http handler references ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/733)) - Remove version disclosure on login page ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/737)) From 63133809226c73bad67e9d88008d65f93cdb1cb8 Mon Sep 17 00:00:00 2001 From: Zedifus Date: Sat, 6 Apr 2024 22:54:43 +0100 Subject: [PATCH 3/4] Fix calling of orjson .JSONDecodeError class --- app/classes/web/routes/api/crafty/config/index.py | 4 ++-- app/classes/web/routes/api/crafty/config/server_dir.py | 2 +- app/classes/web/routes/api/roles/role/index.py | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/app/classes/web/routes/api/crafty/config/index.py b/app/classes/web/routes/api/crafty/config/index.py index b95d15a0..40504d76 100644 --- a/app/classes/web/routes/api/crafty/config/index.py +++ b/app/classes/web/routes/api/crafty/config/index.py @@ -106,7 +106,7 @@ class ApiCraftyConfigIndexHandler(BaseApiHandler): try: data = orjson.loads(self.request.body) - except orjson.decoder.JSONDecodeError as e: + except orjson.JSONDecodeError as e: return self.finish_json( 400, {"status": "error", "error": "INVALID_JSON", "error_data": str(e)} ) @@ -187,7 +187,7 @@ class ApiCraftyCustomizeIndexHandler(BaseApiHandler): try: data = orjson.loads(self.request.body) - except orjson.decoder.JSONDecodeError as e: + except orjson.JSONDecodeError as e: return self.finish_json( 400, {"status": "error", "error": "INVALID_JSON", "error_data": str(e)} ) diff --git a/app/classes/web/routes/api/crafty/config/server_dir.py b/app/classes/web/routes/api/crafty/config/server_dir.py index 87835d35..07cf7c26 100644 --- a/app/classes/web/routes/api/crafty/config/server_dir.py +++ b/app/classes/web/routes/api/crafty/config/server_dir.py @@ -68,7 +68,7 @@ class ApiCraftyConfigServerDirHandler(BaseApiHandler): try: data = orjson.loads(self.request.body) - except orjson.decoder.JSONDecodeError as e: + except orjson.JSONDecodeError as e: return self.finish_json( 400, {"status": "error", "error": "INVALID_JSON", "error_data": str(e)} ) diff --git a/app/classes/web/routes/api/roles/role/index.py b/app/classes/web/routes/api/roles/role/index.py index a45c297f..97362f5b 100644 --- a/app/classes/web/routes/api/roles/role/index.py +++ b/app/classes/web/routes/api/roles/role/index.py @@ -133,7 +133,7 @@ class ApiRolesRoleIndexHandler(BaseApiHandler): try: data = orjson.loads(self.request.body) - except orjson.decoder.JSONDecodeError as e: + except orjson.JSONDecodeError as e: return self.finish_json( 400, {"status": "error", "error": "INVALID_JSON", "error_data": str(e)} ) From 21394211355191f1ba9dbc59dfecc2abe19bc76d Mon Sep 17 00:00:00 2001 From: Zedifus Date: Sat, 6 Apr 2024 22:56:14 +0100 Subject: [PATCH 4/4] Update changelog !747 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 66b9b363..7c9c1d05 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ TBD - Fix backend issue causing error when restoring backups in 4.3.x ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/736)) - Fix backend issue causing error when cloning servers in 4.3.x ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/741)) - Bump orjson for CVE-2024-27454 ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/747)) +- Fix calling of orjson JSONDecodeError class ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/747)) ### Tweaks - Clean up remaining http handler references ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/733)) - Remove version disclosure on login page ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/737))