MEDIUM5.9

PYSEC-2026-921

simplejson before 2.6.1 vulnerable to array index error

Quick fix

PYSEC-2026-921 — simplejson: upgrade to the fixed version with the command below.

pip install --upgrade 'simplejson>=2.6.1'

Details

Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/simplejson

Introduced in: 0Fixed in: 2.6.1

Fixpip install --upgrade 'simplejson>=2.6.1'

References

https://nvd.nist.gov/vuln/detail/CVE-2014-4616[ADVISORY]
https://hackerone.com/reports/12297[WEB]
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752395[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=1112285[WEB]
https://github.com/simplejson/simplejson[PACKAGE]
https://security.gentoo.org/glsa/201503-10[WEB]
http://bugs.python.org/issue21529[WEB]
http://lists.opensuse.org/opensuse-updates/2014-07/msg00015.html[WEB]
http://openwall.com/lists/oss-security/2014/06/24/7[WEB]
http://rhn.redhat.com/errata/RHSA-2015-1064.html[WEB]
http://www.securityfocus.com/bid/68119[WEB]
https://pypi.org/project/simplejson[PACKAGE]
https://github.com/advisories/GHSA-9772-cwx9-r4cj[ADVISORY]