There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.

An update of the yajl package has been released.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795)

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:6551 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2580 advisory.

    Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a     small validating JSON generator.

    Security Fix(es):

    * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2063 advisory.

    Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a     small validating JSON generator.

    Security Fix(es):

    * yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795)

    * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the yajl-2.1.0-22.el9 build changelog.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6233-2 advisory.

  - In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the     whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This     results in the whole ruby process terminating and potentially a denial of service. (CVE-2017-16516)

  - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:7057 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-7057 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-6551 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7057 advisory.

  - yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7057 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6551 advisory.

  - yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3301-1 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of yajl installed on the remote host is prior to 2.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2182 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-279 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3516 advisory.

  - In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the     whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This     results in the whole ruby process terminating and potentially a denial of service. (CVE-2017-16516)

  - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-852b377773 advisory.

  - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0b0bb84049 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6233-1 advisory.

  - In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the     whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This     results in the whole ruby process terminating and potentially a denial of service. (CVE-2017-16516)

  - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-00572178e1 advisory.

  - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3492 advisory.

  - In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the     whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This     results in the whole ruby process terminating and potentially a denial of service. (CVE-2017-16516)

  - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3478 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of yajl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-33460 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-214 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203651	Photon OS 5.0: Yajl PHSA-2023-5.0-0096	Nessus	PhotonOS Local Security Checks	medium
199621	RHEL 8 : yajl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196982	Rocky Linux 9 : yajl (RLSA-2023:6551)	Nessus	Rocky Linux Local Security Checks	medium
194829	RHEL 8 : yajl (RHSA-2024:2580)	Nessus	Red Hat Local Security Checks	medium
193894	RHEL 8 : yajl (RHSA-2024:2063)	Nessus	Red Hat Local Security Checks	high
191373	CentOS 9 : yajl-2.1.0-22.el9	Nessus	CentOS Local Security Checks	medium
186986	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : YAJL vulnerabilities (USN-6233-2)	Nessus	Ubuntu Local Security Checks	high
186405	Rocky Linux 8 : yajl (RLSA-2023:7057)	Nessus	Rocky Linux Local Security Checks	medium
186129	Oracle Linux 8 : yajl (ELSA-2023-7057)	Nessus	Oracle Linux Local Security Checks	medium
185858	Oracle Linux 9 : yajl (ELSA-2023-6551)	Nessus	Oracle Linux Local Security Checks	medium
185703	RHEL 8 : yajl (RHSA-2023:7057)	Nessus	Red Hat Local Security Checks	medium
185630	CentOS 8 : yajl (CESA-2023:7057)	Nessus	CentOS Local Security Checks	medium
185123	RHEL 9 : yajl (RHSA-2023:6551)	Nessus	Red Hat Local Security Checks	medium
179820	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libyajl (SUSE-SU-2023:3301-1)	Nessus	SuSE Local Security Checks	medium
179789	Amazon Linux 2 : yajl (ALAS-2023-2182)	Nessus	Amazon Linux Local Security Checks	medium
179748	Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-279)	Nessus	Amazon Linux Local Security Checks	medium
179386	Debian DLA-3516-1 : burp - LTS security update	Nessus	Debian Local Security Checks	high
178918	Fedora 37 : yajl (2023-852b377773)	Nessus	Fedora Local Security Checks	high
178698	Fedora 38 : R-jsonlite (2023-0b0bb84049)	Nessus	Fedora Local Security Checks	medium
178443	Ubuntu 16.04 ESM / 18.04 ESM : YAJL vulnerabilities (USN-6233-1)	Nessus	Ubuntu Local Security Checks	high
178323	Fedora 38 : yajl (2023-00572178e1)	Nessus	Fedora Local Security Checks	high
178173	Debian DLA-3492-1 : yajl - LTS security update	Nessus	Debian Local Security Checks	high
177886	Debian DLA-3478-1 : yajl - LTS security update	Nessus	Debian Local Security Checks	medium
177818	CBL Mariner 2.0 Security Update: yajl (CVE-2023-33460)	Nessus	MarinerOS Local Security Checks	medium
177680	Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-214)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2023-33460

medium

Tenable Plugins

medium

high

medium

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium

high

high

high

medium

medium

medium