Array Index Error in Python _json Module
Summary
CVE-2014-4616: Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the... Affects python versions < 2.7.7-r0. Fixed in 2.7.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Python programming language is widely used for various applications and is known for its simplicity and readability. The _json module in Python provides functionality for encoding and decoding JSON data. This vulnerability, identified as CVE-2014-4616, affects Python versions 2.7 through 3.5 and simplejson before 2.6.1. It is caused by an array index error in the scanstring function of the _json module. Attackers can exploit this vulnerability to read arbitrary process memory by providing a negative index value in the idx argument to the raw_decode function.
Vulnerability Detail
The vulnerability arises due to an array index error in the scanstring function of the _json module. By supplying a negative index value in the idx argument to the raw_decode function, an attacker can read arbitrary process memory. This can lead to unauthorized access to sensitive information, potential information disclosure, and other security issues. The vulnerability has a CVSS v3 score of 5.9, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.7.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can protect themselves by updating their Python package to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The array index error in the scanstring function of the _json module in Python versions 2.7 through 3.5 and simplejson before 2.6.1 can lead to unauthorized access to process memory. To mitigate this vulnerability, it is crucial to update the Python package to version 2.7.7-r0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python →
FAQ
This vulnerability allows attackers to read arbitrary process memory, potentially leading to unauthorized access to sensitive information.
Python versions 2.7 through 3.5 and simplejson before 2.6.1 are affected.
Yes, the CVSS v3 score for this vulnerability is 5.9, indicating a moderate severity level.
Specific known exploits for this vulnerability are not mentioned in the provided information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for python.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
