CVE-2014-4616

Public on 2014-07-09
Modified on 2014-09-19
Description
A flaw was found in the way the json module handled negative index argument passed to certain functions (such as raw_decode()). An attacker able to control index value passed to one of the affected functions could possibly use this flaw to disclose portions of the application memory.
Severity
Medium severity
Medium
CVSS v3 Base Score
4.0
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 python-simplejson 2014-07-09 ALAS-2014-374 Fixed
Amazon Linux 1 python27 2014-07-23 ALAS-2014-380 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv2 4.0 AV:N/AC:H/Au:N/C:P/I:N/A:P
NVD CVSSv3 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD CVSSv2 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N