Memory leak in yajl - CVE-2023-33460

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU77812

Memory leak in yajl - CVE-2023-33460

Published: June 29, 2023


Vulnerability identifier: #VU77812
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-33460
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the yajl_tree_parse() function. A remote attacker can perform a denial of service attack.


Affected software

yajl
Oracle Linux
Amazon Linux AMI
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Anolis OS
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Basesystem Module
openSUSE Leap
Fedora
OpenShift Pipelines
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
R-jsonlite
yajl-doc
yajl-devel
yajl
yajl (Red Hat package)
libyajl-debugsource
libyajl2-32bit-debuginfo
libyajl2-32bit
libyajl-devel-32bit
libyajl-devel
libyajl-devel-static
yajl-debuginfo
libyajl2-debuginfo
libyajl2
ObjectScale
Multicluster Engine for Kubernetes
Red Hat OpenShift Container Platform

How to mitigate CVE-2023-33460

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

OpenShift Pipelines - update to 1.10.6
ObjectScale - update to 1.4.0
R-jsonlite - update to 1.8.5-2.fc38
yajl-doc - addressed in versions 2.1.0-2, 2.1.0-12.0.1, 2.1.0-13.0.1
yajl-devel - addressed in versions 2.1.0-2, 2.1.0-12.0.1, 2.1.0-13.0.1
yajl - addressed in versions 2.1.0-2, 2.1.0-12.0.1, 2.1.0-13.0.1
yajl (Red Hat package) - addressed in versions 2.1.0-12.el8, 2.1.0-12.el8_8, 2.1.0-13.el8_6, 2.1.0-22.el9
yajl - update to 2.1.0-16
yajl - addressed in versions 2.1.0-21.fc37, 2.1.0-21.fc38
libyajl-debugsource - update to 2.1.0-150000.4.6.1
libyajl2-32bit-debuginfo - update to 2.1.0-150000.4.6.1
libyajl2-32bit - update to 2.1.0-150000.4.6.1
libyajl-devel-32bit - update to 2.1.0-150000.4.6.1
libyajl-devel - update to 2.1.0-150000.4.6.1
libyajl-devel-static - update to 2.1.0-150000.4.6.1
yajl - update to 2.1.0-150000.4.6.1
yajl-debuginfo - update to 2.1.0-150000.4.6.1
libyajl2-debuginfo - update to 2.1.0-150000.4.6.1
libyajl2 - update to 2.1.0-150000.4.6.1
Multicluster Engine for Kubernetes - update to 2.7.4
Red Hat OpenShift Container Platform - addressed in versions 4.15.12, 4.15.13, 4.16.15, 4.17.0

External References

Related Security Bulletins