Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade pythonUpgrade python2 | Oct 1, 2024 | Aug 24, 2017 |
| Debian | — | Upgrade python2.7 | Jul 30, 2024 | Aug 24, 2017 |
| Gentoo Linux | — | Upgrade dev-lang/python. | Oct 30, 2017 | Aug 24, 2017 |
| Oracle_linux | — | Upgrade python27-pythonUpgrade python27-python-toolsUpgrade python27-python-testUpgrade python27-python-libsUpgrade python27-scldevelUpgrade python27-python-wheelUpgrade python-debugUpgrade python27-runtimeUpgrade pythonUpgrade python-toolsUpgrade python-develUpgrade python27-tkinterUpgrade python27-python-simplejsonUpgrade python27Upgrade python27-python-setuptoolsUpgrade python-testUpgrade python27-python-debugUpgrade tkinterUpgrade python27-python-pipUpgrade python-libsUpgrade python27-python-devel | Oct 16, 2024 | Aug 24, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 24, 2017 |
| Suse | — | Upgrade python3-tkUpgrade python-debuginfo-32bitUpgrade python3-testsuiteUpgrade python3-base-debuginfo-32bitUpgrade python-debuginfoUpgrade python3-docUpgrade python3-base-debugsourceUpgrade python-base-debuginfoUpgrade python-xmlUpgrade python3-toolsUpgrade python3-testsuite-debuginfoUpgrade python3-base-32bitUpgrade python3-debugsourceUpgrade python-xml-debuginfoUpgrade python-base-32bitUpgrade libpython3_3m1_0Upgrade python-cursesUpgrade python-develUpgrade python3-32bitUpgrade libpython2_7-1_0Upgrade libpython2_7-1_0-debuginfoUpgrade python3-cursesUpgrade libpython2_7-1_0-debuginfo-32bitUpgrade python3-doc-pdfUpgrade python-demoUpgrade python-base-debuginfo-32bitUpgrade python3Upgrade python-curses-debuginfoUpgrade python3-tk-debuginfoUpgrade python3-dbmUpgrade python-idleUpgrade pythonUpgrade python3-debuginfoUpgrade python-doc-pdfUpgrade python3-baseUpgrade libpython3_3m1_0-32bitUpgrade libpython2_7-1_0-32bitUpgrade python-32bitUpgrade python-baseUpgrade libpython3_3m1_0-debuginfoUpgrade python-gdbm-debuginfoUpgrade python-base-debugsourceUpgrade python-tkUpgrade python3-base-debuginfoUpgrade python-tk-debuginfoUpgrade python-debugsourceUpgrade python3-develUpgrade libpython3_3m1_0-debuginfo-32bitUpgrade python3-dbm-debuginfoUpgrade python3-devel-debuginfoUpgrade python3-debuginfo-32bitUpgrade python-docUpgrade python3-idleUpgrade python3-curses-debuginfoUpgrade python-gdbm | Dec 18, 2015 | Jul 12, 2014 |
| Ubuntu | — | Upgrade python3.4Upgrade python2.7Upgrade python2.7-minimalUpgrade python3.2-minimalUpgrade python3.4-minimalUpgrade python3.2 | Nov 8, 2024 | Aug 24, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub