CVE-2023-33460

NameCVE-2023-33460
DescriptionThere's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3478-1, DLA-3492-1
Debian Bugs1039984, 1059316, 1059317

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
epics-base (PTS)bookworm7.0.3.1-4vulnerable
sid, trixie7.0.8.1+dfsg1-2vulnerable
r-cran-jsonlite (PTS)bullseye1.7.2+dfsg-1vulnerable
bookworm1.8.4+dfsg-1vulnerable
sid, trixie1.8.9+dfsg-1vulnerable
ruby-yajl (PTS)bullseye1.4.1-1fixed
sid, trixie, bookworm1.4.3-1fixed
yajl (PTS)bullseye2.1.0-3+deb11u2fixed
bookworm2.1.0-3+deb12u2fixed
sid, trixie2.1.0-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
epics-basesource(unstable)(unfixed)1059316
r-cran-jsonlitesource(unstable)(unfixed)1059317
ruby-yajlsource(unstable)(not affected)
yajlsourcebuster2.1.0-3+deb10u2DLA-3492-1
yajlsourcebullseye2.1.0-3+deb11u2
yajlsourcebookworm2.1.0-3+deb12u2
yajlsource(unstable)2.1.0-51039984

Notes

https://github.com/lloyd/yajl/issues/250
Introduced with: https://github.com/lloyd/yajl/commit/cfa9f8fcb12d80dd5ebf94f5e6a607aab4d225fb (2.0.0)
The original fix uploaded as 2.1.0-3.1 was incomplete.
[bookworm] - epics-base <no-dsa> (Minor issue)
[buster] - epics-base <postponed> (Minor issue; fix only after newer releases got a fix)
[bookworm] - r-cran-jsonlite <no-dsa> (Minor issue)
[bullseye] - r-cran-jsonlite <no-dsa> (Minor issue)
[buster] - r-cran-jsonlite <postponed> (Minor issue; fix only after newer releases got a fix)
- ruby-yajl <not-affected> (Vulnerable code not present; embeds not-affected old yajl version)
ruby-yajl embeds yajl version 1.0.12 (https://github.com/brianmario/yajl-ruby/blob/master/ext/yajl/api/yajl_version.h)

Search for package or bug name: Reporting problems