CVE-2014-4616: simplejson before 2.6.1 vulnerable to array index error
Summary
CVE-2014-4616: simplejson before 2.6.1 vulnerable to array index error. Affects simplejson versions < 2.6.1. Fixed in 2.6.1. How to fix ↓
Also tracked for
- python · Alpine:v3.4
The same CVE-2014-4616 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
simplejson is a Python library that provides a fast and efficient way to encode and decode JSON data. It is widely used in various Python applications and frameworks. However, versions of simplejson before 2.6.1 are susceptible to an array index error vulnerability.
Vulnerability Detail
The vulnerability exists in the scanstring function of the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1. It allows context-dependent attackers to read arbitrary process memory by exploiting a negative index value in the idx argument of the raw_decode function. This vulnerability can potentially lead to unauthorized access to sensitive information stored in the process memory.
How To Fix
Minimum fixed version
2.6.1
This is the first release that contains the fix.
pip install --upgrade "simplejson==2.6.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to the patched version of simplejson.
Conclusion
In conclusion, the simplejson package before version 2.6.1 is vulnerable to an array index error. This vulnerability can be mitigated by upgrading to the latest version of the package. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplejson →
FAQ
simplejson is a Python library used for encoding and decoding JSON data.
Versions of simplejson before 2.6.1 are vulnerable to this array index error.
This vulnerability allows attackers to read arbitrary process memory, potentially leading to unauthorized access to sensitive information.
To fix this vulnerability, upgrade the simplejson package to version 2.6.1 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the fix by upgrading the package.
