CVE-2022-25024: 
Python vulnerability analysis and mitigation

The json2xml package through version 3.12.0 for Python contains a vulnerability where an error in typecode decoding enables a remote attack that can lead to an exception, causing a denial of service (NVD, CVE). The vulnerability was discovered and disclosed in February 2022.

The vulnerability stems from an uncaught UnicodeDecodeError that occurs when calling the to_xml() method with arbitrary data. When malformed or corrupt data is passed into the json2xml.Json2xml() constructor, it can raise an unhandled exception that brings the program to a halt (GitHub Issue). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a denial of service condition by crashing the running program. This is particularly problematic when the library is processing untrusted data, as it allows remote attackers to trigger program termination (GitHub Issue).

The vulnerability was fixed in version 3.14.0 of the json2xml package. The fix introduces a new error type (InvalidDataError) that properly handles the exception and allows programs to catch and log these errors instead of crashing (GitHub PR). Users should upgrade to version 3.14.0 or later to mitigate this vulnerability.