GitHub Advisoryadvisory · PyPI

GHSA-9772-cwx9-r4cj simplejson before 2.6.1 vulnerable to array index error

MEDIUM Published 2022-05-14 Modified 2022-07-27 Official page ↗
Aliases
CVE-2014-4616
Ecosystem
PyPI
Packages
simplejson
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-129
Reviewed
2022-07-27

Affected packages

• PyPI simplejson: < 2.6.1 → fixed in 2.6.1

Description

Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.

Related

Alias · CVE (1)

  • CVE-2014-4616 Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows… vulnerability

Weakness · CWE (1)

  • CWE-129 Improper Validation of Array Index weakness

References