CVE-2023-33460: Medium severity Yajl Project Yajl vulnerability

Q: What is the severity of CVE-2023-33460?

CVE-2023-33460 is considered a medium severity vulnerability due to its potential to cause out-of-memory errors and crashes.

Q: How do I fix CVE-2023-33460?

To fix CVE-2023-33460, upgrade the yajl package to a version higher than 2.1.0, specifically to versions 2.0.4-4ubuntu0.1~ or any recommended patched version.

Q: Which software is affected by CVE-2023-33460?

CVE-2023-33460 affects yajl version 2.1.0 and earlier versions across various distributions, including Ubuntu and Debian.

Q: What are the consequences of not addressing CVE-2023-33460?

Failing to address CVE-2023-33460 can lead to memory leaks, causing application crashes and potential service downtime.

Q: Is there a specific workaround for CVE-2023-33460?

While a specific workaround isn't provided, users are strongly advised to update to a patched version of yajl to mitigate risks associated with CVE-2023-33460.

Published Jun 6, 2023

Updated

There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash.

Affected Software

15 affected componentsFixes available

ubuntu/yajl<2.0.4-4ubuntu0.1~

2.0.4-4ubuntu0.1~

ubuntu/yajl<2.1.0-2ubuntu0.16.04.1~

2.1.0-2ubuntu0.16.04.1~

ubuntu/yajl<2.1.0-2ubuntu0.18.04.1~

2.1.0-2ubuntu0.18.04.1~

ubuntu/yajl<2.1.0-3+

2.1.0-3+

ubuntu/yajl<2.1.0-3ubuntu0.20.04.1

2.1.0-3ubuntu0.20.04.1

ubuntu/yajl<2.1.0-3ubuntu0.22.04.1

2.1.0-3ubuntu0.22.04.1

ubuntu/yajl<2.1.0-3ubuntu0.23.04.1

2.1.0-3ubuntu0.23.04.1

debian/epics-base<=7.0.3.1-4, <=7.0.8+dfsg1-1

debian/r-cran-jsonlite<=1.6+dfsg-1, <=1.7.2+dfsg-1, <=1.8.4+dfsg-1, <=1.8.8+dfsg-1

debian/ruby-yajl

1.3.1-11.4.1-11.4.3-1

debian/yajl<=2.1.0-3

2.1.0-3+deb10u22.1.0-3+deb11u22.1.0-3+deb12u22.1.0-5

Yajl Project Yajl=2.1.0

Fedoraproject Fedora=37

Fedoraproject Fedora=38

Debian Debian Linux=10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/yajl to a version that resolves this vulnerability.
Fixed in 2.0.4-4ubuntu0.1~
Upgrade
Upgrade ubuntu/yajl to a version that resolves this vulnerability.
Fixed in 2.1.0-2ubuntu0.16.04.1~
Upgrade
Upgrade ubuntu/yajl to a version that resolves this vulnerability.
Fixed in 2.1.0-2ubuntu0.18.04.1~
Upgrade
Upgrade ubuntu/yajl to a version that resolves this vulnerability.
Fixed in 2.1.0-3+
Upgrade
Upgrade ubuntu/yajl to a version that resolves this vulnerability.
Fixed in 2.1.0-3ubuntu0.20.04.1
Upgrade
Upgrade ubuntu/yajl to a version that resolves this vulnerability.
Fixed in 2.1.0-3ubuntu0.22.04.1
Upgrade
Upgrade ubuntu/yajl to a version that resolves this vulnerability.
Fixed in 2.1.0-3ubuntu0.23.04.1
Upgrade
Upgrade debian/ruby-yajl to a version that resolves this vulnerability.
Fixed in 1.3.1-1Fixed in 1.4.1-1Fixed in 1.4.3-1
Upgrade
Upgrade debian/yajl to a version that resolves this vulnerability.
Fixed in 2.1.0-3+deb10u2Fixed in 2.1.0-3+deb11u2Fixed in 2.1.0-3+deb12u2Fixed in 2.1.0-5

Event History

Jun 6, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·12:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jul 7, 2023

Data Sourced

via Red Hat·04:29 PM

DescriptionSeverityAffected Software

Jan 12, 2024

Data Sourced

via Launchpad·12:20 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2023-33460?

CVE-2023-33460 is considered a medium severity vulnerability due to its potential to cause out-of-memory errors and crashes.

How do I fix CVE-2023-33460?

To fix CVE-2023-33460, upgrade the yajl package to a version higher than 2.1.0, specifically to versions 2.0.4-4ubuntu0.1~ or any recommended patched version.

Which software is affected by CVE-2023-33460?

CVE-2023-33460 affects yajl version 2.1.0 and earlier versions across various distributions, including Ubuntu and Debian.

What are the consequences of not addressing CVE-2023-33460?

Failing to address CVE-2023-33460 can lead to memory leaks, causing application crashes and potential service downtime.

Is there a specific workaround for CVE-2023-33460?

While a specific workaround isn't provided, users are strongly advised to update to a patched version of yajl to mitigate risks associated with CVE-2023-33460.

CVE-2023-33460: Medium severity Yajl Project Yajl vulnerability

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the severity of CVE-2023-33460?

How do I fix CVE-2023-33460?

Which software is affected by CVE-2023-33460?

What are the consequences of not addressing CVE-2023-33460?

Is there a specific workaround for CVE-2023-33460?

Company

Resources

Contact