Skip to content
Fencer Intel
medium 5.9

CVE-2014-4616 json

simplejson before 2.6.1 vulnerable to array index error

published 2017-08-24 9 y ago modified 2026-07-07 4 mo ago also GHSA-9772-cwx9-r4cj , PYSEC-2026-921 , EUVD-2022-3310

cvss
5.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
7.8%
EPSS 7.8% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.

Patch / fix

  • pypi simplejson 2.6.1
  • python python 2.7.7, 3.2.6, 3.3.6, 3.4.1
  • simplejson_project simplejson 2.6.1
  • python2.7 Debian 11 2.7.7-1

debian advisories DEBIAN-CVE-2014-4616

  • python2.7 Ubuntu 14.04 LTS 2.7.6-8ubuntu0.2
  • python3.4 Ubuntu 14.04 LTS 3.4.0-2ubuntu1.1

ubuntu advisories UBUNTU-CVE-2014-4616

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • v8 satellite capsule 6.0, satellite 6.0 1:3.14.5.10-9.el6sat
  • v8 satellite capsule 6.0, satellite 6.0 1:3.14.5.10-11.el7sat
  • foreman satellite 6.0 1.6.0.44-1.el6sat
  • foreman satellite 6.0 1.6.0.44-1.el7sat
  • katello satellite 6.0 1.5.0-30.el6sat
  • katello satellite 6.0 1.5.0-30.el7sat
  • mongodb satellite capsule 6.0, satellite 6.0 2.4.6-2.el6sat
  • mongodb satellite capsule 6.0, satellite 6.0 2.4.9-3.el7sat

red hat advisories RHEA-2014:1175RHSA-2015:2101RHSA-2015:1064

  • python Alpine 3.4 2.7.7-r0
  • python2 Alpine 3.6, Alpine 3.5 2.7.7-r0

alpine advisories ALPINE-CVE-2014-4616

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-4616 updated cvss 4.0

python: missing boundary check in JSON module

  • Red Hat Enterprise Linux 5 python-simplejson Red Hat Enterprise Linux 6 python-simplejson
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) python-simplejson
    affected: no fix available
  • Red Hat Software Collections python27-python, python33-python, python27-tkinter, python27-python-libs, python27-python-test, python33-python-libs, +6 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) python 2.7.5-34.el7, python-libs 2.7.5-34.el7 Red Hat Enterprise Linux Client Optional (v. 7) tkinter 2.7.5-34.el7, python-test 2.7.5-34.el7, python-tools 2.7.5-34.el7 Red Hat Enterprise Linux ComputeNode (v. 7) python 2.7.5-34.el7, python-libs 2.7.5-34.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) tkinter 2.7.5-34.el7, python-test 2.7.5-34.el7, python-tools 2.7.5-34.el7 Red Hat Enterprise Linux Server (v. 7) python 2.7.5-34.el7, python-libs 2.7.5-34.el7 Red Hat Enterprise Linux Server Optional (v. 7) tkinter 2.7.5-34.el7, python-test 2.7.5-34.el7, python-tools 2.7.5-34.el7
    +2 more products
    Red Hat Enterprise Linux Workstation (v. 7) python 2.7.5-34.el7, python-libs 2.7.5-34.el7 Red Hat Enterprise Linux Workstation Optional (v. 7) tkinter 2.7.5-34.el7, python-test 2.7.5-34.el7, python-tools 2.7.5-34.el7
    fixed: vendor fix RHSA-2015:2101
  • Red Hat Satellite 6.0 python-anyjson 0.3.3-4.el6sat, python-anyjson 0.3.3-5.el7sat, python-simplejson 3.2.0-1.el7sat Red Hat Satellite Capsule 6.0 python-anyjson 0.3.3-4.el6sat, python-anyjson 0.3.3-5.el7sat, python-simplejson 3.2.0-1.el7sat
    fixed: vendor fix RHEA-2014:1175
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) python27 1.1-17.el6, python27-python 2.7.8-3.el6, python27-runtime 1.1-17.el6, python27-scldevel 1.1-17.el6, python27-tkinter 2.7.8-3.el6, python27-python-pip 1.5.6-5.el6, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27 1.1-20.el7, python27-python 2.7.8-3.el7, python27-runtime 1.1-20.el7, python27-scldevel 1.1-20.el7, python27-tkinter 2.7.8-3.el7, python27-python-pip 1.5.6-5.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) python27 1.1-17.el6, python27-python 2.7.8-3.el6, python27-runtime 1.1-17.el6, python27-scldevel 1.1-17.el6, python27-tkinter 2.7.8-3.el6, python27-python-pip 1.5.6-5.el6, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) python27 1.1-17.el6, python27-python 2.7.8-3.el6, python27-runtime 1.1-17.el6, python27-scldevel 1.1-17.el6, python27-tkinter 2.7.8-3.el6, python27-python-pip 1.5.6-5.el6, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) python27 1.1-17.el6, python27-python 2.7.8-3.el6, python27-runtime 1.1-17.el6, python27-scldevel 1.1-17.el6, python27-tkinter 2.7.8-3.el6, python27-python-pip 1.5.6-5.el6, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27 1.1-20.el7, python27-python 2.7.8-3.el7, python27-runtime 1.1-20.el7, python27-scldevel 1.1-20.el7, python27-tkinter 2.7.8-3.el7, python27-python-pip 1.5.6-5.el7, +6 more
    fixed: vendor fix RHSA-2015:1064
  • Red Hat Enterprise Linux 5 python Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Satellite 6.0 jansi 1.9-7.el7, bsf 2.4.0-19.el7, cglib 2.2-18.el7, guava 13.0-6.el7, xbean 3.13-6.el7, hawtjni 1.6-9.el7, +756 more Red Hat Satellite 6.0 - Optional ant-jmf 1.9.2-9.el7, ant-jsch 1.9.2-9.el7, ant-antlr 1.9.2-9.el7, ant-swing 1.9.2-9.el7, ant-manual 1.9.2-9.el7, ant-javadoc 1.9.2-9.el7, +21 more Red Hat Satellite Capsule 6.0 hiera 1.3.1-2.el7, hiera 1.0.0-3.el6_4, gofer 1.3.0-1.el6sat, gofer 1.3.0-1.el7sat, qpid-cpp 0.22-42.el6, qpid-cpp 0.22-42.el7, +216 more Red Hat Software Collections rh-python34-python, rh-python34-python-libs, rh-python34-python-test, rh-python34-python-tools, rh-python34-python-tkinter
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

7.85% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • hackerone.com https://hackerone.com/reports/12297 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
OSV 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi simplejson
<2.6.1
2.6.1

Classification

Weakness
  • CWE-129 Improper Validation of Array Index

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.