[SNYK: High] Out-of-Bounds Write (Due 03/18/2022)

[patphongs]

Affected versions of this package are vulnerable to Out-of-Bounds Write via a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode).

https://security.snyk.io/vuln/SNYK-PYTHON-UJSON-2359034

How to fix?
There is no fixed version for ujson.

No remediation path currently, as of 2/28/22.

Completion criteria:

• Updated with remediation path if one becomes available during sprint
• If not remediation path by 3/14 notify security team and push to next sprint. ("We use ujson for X, etc.)
• solved in Upgrade Ujson to 520 #5109

[pkfec]

@fec-jli Remediation path for ujson is now available. You may upgrade to 5.2.0 or higher
https://security.snyk.io/vuln/SNYK-PYTHON-UJSON-2359034

cc @patphongs