Description
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | python2.7 | 2.7.7-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | python2.7 | 2.7.6-8ubuntu0.2 | USN-2653-1 |
| Ubuntu 14.04 LTS | python3.4 | 3.4.0-2ubuntu1.1 | USN-2653-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | python +6 | 2.7.5-34.el7 | RHSA-2015:2101 |
| RHEL 2 | python27 +2 | 1.1-17.el6 | RHSA-2015:1064 |
| RHEL 2 | python27-python +6 | 2.7.8-3.el6 | RHSA-2015:1064 |
| RHEL 2 | python27-python-pip | 1.5.6-5.el6 | RHSA-2015:1064 |
| RHEL 2 | python27-python-setuptools | 0.9.8-3.el6 | RHSA-2015:1064 |
| RHEL 2 | python27-python-simplejson | 3.2.0-2.el6 | RHSA-2015:1064 |
| RHEL 2 | python27-python-wheel | 0.24.0-2.el6 | RHSA-2015:1064 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman-proxy | 1.6.0.30-1.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | mongodb +2 | 2.4.6-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | python-anyjson | 0.3.3-4.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | python-httplib2 | 0.6.0-6.el7sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | python-simplejson | 3.2.0-1.el7sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | rubygem-kafo | 0.6.4-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | rubygem-kafo_parsers | 0.0.3-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | v8 | 1:3.14.5.10-9.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | foreman +6 | 1.6.0.44-1.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | foreman-proxy | 1.6.0.30-1.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | katello | 1.5.0-30.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | mongodb +2 | 2.4.6-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | python-anyjson | 0.3.3-4.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | python-httplib2 | 0.6.0-6.el7sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | python-simplejson | 3.2.0-1.el7sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-hammer_cli_foreman | 0.1.1-16.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-hammer_cli_foreman_tasks | 0.0.3-3.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-kafo | 0.6.4-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-kafo_parsers | 0.0.3-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | v8 | 1:3.14.5.10-9.el6sat | RHEA-2014:1175 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.6 | python2 | 2.7.7-r0 | — |
| Alpine v3.5 | python2 | 2.7.7-r0 | — |
| Alpine v3.4 | python | 2.7.7-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | python +6 | 2.7.5-34.0.1.el7 | ELSA-2015-2101 |
| Oracle Linux 7 | python27 +2 | 1.1-20.el7 | ELSA-2015-1064 |
| Oracle Linux 7 | python27-python +6 | 2.7.8-3.el7 | ELSA-2015-1064 |
| Oracle Linux 7 | python27-python-pip | 1.5.6-5.el7 | ELSA-2015-1064 |
| Oracle Linux 7 | python27-python-setuptools | 0.9.8-5.el7 | ELSA-2015-1064 |
| Oracle Linux 7 | python27-python-simplejson | 3.2.0-3.el7 | ELSA-2015-1064 |
| Oracle Linux 7 | python27-python-wheel | 0.24.0-2.el7 | ELSA-2015-1064 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | simplejson | < 2.6.1 | 2.6.1 | GHSA-9772-cwx9-r4cj |
Advisories 6
- RHEA-2014:1175 Red Hat Enhancement Advisory: Release of Satellite 6.0 Red Hat Security Advisories (RHSA) · Oct 7, 2026
- RHSA-2015:2101 Red Hat Security Advisory: python security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:1064 Red Hat Security Advisory: python27 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-2653-1 python2.7, python3.2, python3.4 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- ELSA-2015-1064 Moderate: python27 security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 4, 2016
- ELSA-2015-2101 Moderate: python security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 23, 2015
References
- https://hackerone.com/reports/12297
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752395
- RHSA-2015:1064 vendor-advisory
- 68119 vdb-entry
- openSUSE-SU-2014:0890 vendor-advisory
- GLSA-201503-10 vendor-advisory
- [oss-security] 20140624 Re: CVE request: python: _json module is vulnerable to arbitrary process memory read mailing-list
- http://bugs.python.org/issue21529
- https://bugzilla.redhat.com/show_bug.cgi?id=1112285