Several security issues were fixed in YAJL.. ========================================================================== Ubuntu Security Notice USN-6233-2 December 14, 2023 yajl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in YAJL. Software Description: - yajl: Yet Another JSON Library Details: USN-6233-1 fixed vulnerabilities in YAJL. This update provides the corresponding updates for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. Original advisory details: It was discovered that YAJL was not properly performing bounds checks when decoding a string with escape sequences. If a user or automated system using YAJL were tricked into processing specially crafted input, an attacker could possibly use this issue to cause a denial of service (application abort). (CVE-2017-16516) It was discovered that YAJL was not properly handling memory allocation when dealing with large inputs, which could lead to heap memory corruption. If a user or automated system using YAJL were tricked into running a specially crafted large input, an attacker could possibly use this issue to cause a denial of service. (CVE-2022-24795) It was discovered that memory leaks existed in one of the YAJL parsing functions. An attacker could possibly use this issue to cause a denial of service (memory exhaustion). (CVE-2023-33460) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: libyajl2 2.1.0-3ubuntu0.23.04.1 Ubuntu 22.04 LTS: libyajl2 2.1.0-3ubuntu0.22.04.1 Ubuntu 20.04 LTS: libyajl2 2.1.0-3ubuntu0.20.04.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6233-2 https://ubuntu.com/security/notices/USN-6233-1 CVE-2017-16516, CVE-2022-24795, CVE-2023-33460 Package Information: https://launchpad.net/ubuntu/+source/yajl/2.1.0-3ubuntu0.23.04.1 https://launchpad.net/ubuntu/+source/yajl/2.1.0-3ubuntu0.22.04.1 https://launchpad.net/ubuntu/+source/yajl/2.1.0-3ubuntu0.20.04.1 . Protect your Ubuntu systems by applying the newest YAJL updates to mitigate security risks and ensure continuous operation.. YAJL Updates, Ubuntu Security, Memory Risks, Denial of Service. . Severity: Critical. LinuxSecurity.com Team
Several security issues were fixed in YAJL.. =========================================================================Ubuntu Security Notice USN-6233-1 July 18, 2023 yajl vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Several security issues were fixed in YAJL. Software Description: - yajl: Yet Another JSON Library Details: It was discovered that YAJL was not properly performing bounds checks when decoding a string with escape sequences. If a user or automated system using YAJL were tricked into processing specially crafted input, an attacker could possibly use this issue to cause a denial of service (application abort). (CVE-2017-16516) It was discovered that YAJL was not properly handling memory allocation when dealing with large inputs, which could lead to heap memory corruption. If a user or automated system using YAJL were tricked into running a specially crafted large input, an attacker could possibly use this issue to cause a denial of service. (CVE-2022-24795) It was discovered that memory leaks existed in one of the YAJL parsing functions. An attacker could possibly use this issue to cause a denial of service (memory exhaustion). (CVE-2023-33460) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS (Available with Ubuntu Pro): libyajl2 2.1.0-2ubuntu0.18.04.1~esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): libyajl2 2.1.0-2ubuntu0.16.04.1~esm1 Ubuntu 14.04 LTS (Available with Ubuntu Pro): libyajl2 2.0.4-4ubuntu0.1~esm1 In general, a standard system updatewill make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6233-1 CVE-2017-16516, CVE-2022-24795, CVE-2023-33460 . Numerous vulnerabilities addressed in YAJL impact Ubuntu users. Make sure to update your systems for enhanced security.. Ubuntu Security Update, YAJL Issues, Denial of Service, Memory Management, Open Source Software. . Severity: Critical. LinuxSecurity.com Team
Multiple vulnerabilties have been found in yajl, a JSON parser / small validating JSON generator# written in ANSI C, which potentially can cause memory corruption or DoS. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3492-1
A memory leak has been found in yajl, a JSON parser / small validating JSON generator written in ANSI C, which might allow an attacker to cause an out of memory situation and potentially causing a crash. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3478-1
An update for yajl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: yajl security update Advisory ID: RHSA-2022:8252-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:8252 Issue date: 2022-11-15 CVE Names: CVE-2022-24795 ==================================================================== 1. Summary: An update for yajl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat CodeReady Linux Builder (v. 9) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64 3. Description: Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes thechanges described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2072912 - CVE-2022-24795 yajl: heap-based buffer overflow when handling large inputs due to an integer overflow 6. Package List: Red Hat Enterprise Linux AppStream (v. 9): Source: yajl-2.1.0-21.el9.src.rpm aarch64: yajl-2.1.0-21.el9.aarch64.rpm yajl-debuginfo-2.1.0-21.el9.aarch64.rpm yajl-debugsource-2.1.0-21.el9.aarch64.rpm ppc64le: yajl-2.1.0-21.el9.ppc64le.rpm yajl-debuginfo-2.1.0-21.el9.ppc64le.rpm yajl-debugsource-2.1.0-21.el9.ppc64le.rpm s390x: yajl-2.1.0-21.el9.s390x.rpm yajl-debuginfo-2.1.0-21.el9.s390x.rpm yajl-debugsource-2.1.0-21.el9.s390x.rpm x86_64: yajl-2.1.0-21.el9.i686.rpm yajl-2.1.0-21.el9.x86_64.rpm yajl-debuginfo-2.1.0-21.el9.i686.rpm yajl-debuginfo-2.1.0-21.el9.x86_64.rpm yajl-debugsource-2.1.0-21.el9.i686.rpm yajl-debugsource-2.1.0-21.el9.x86_64.rpm Red Hat CodeReady Linux Builder (v. 9): aarch64: yajl-debuginfo-2.1.0-21.el9.aarch64.rpm yajl-debugsource-2.1.0-21.el9.aarch64.rpm yajl-devel-2.1.0-21.el9.aarch64.rpm ppc64le: yajl-debuginfo-2.1.0-21.el9.ppc64le.rpm yajl-debugsource-2.1.0-21.el9.ppc64le.rpm yajl-devel-2.1.0-21.el9.ppc64le.rpm s390x: yajl-debuginfo-2.1.0-21.el9.s390x.rpm yajl-debugsource-2.1.0-21.el9.s390x.rpm yajl-devel-2.1.0-21.el9.s390x.rpm x86_64: yajl-debuginfo-2.1.0-21.el9.i686.rpm yajl-debuginfo-2.1.0-21.el9.x86_64.rpm yajl-debugsource-2.1.0-21.el9.i686.rpm yajl-debugsource-2.1.0-21.el9.x86_64.rpm yajl-devel-2.1.0-21.el9.i686.rpm yajl-devel-2.1.0-21.el9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2022-24795 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.1_release_notes/index 8. Contact: The Red Hat security contact is . Morecontact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY3PgsdzjgjWX9erEAQhkcBAAlE0Cpp0ZXfHJMTZOXuYMAWD7quUUu3eQ L6LQ3wmDf0o7sfpl5OyfIM3ptYVRSKOmc0vlphPdgiNB+WDtM3kxUhWFlm5GcTgR qARr8HLjwukV52J9bp3obLzuj1UrgtiWkDTqAT9seIIHqULiUJGZEsDErGipQ1qV R7F4ZQRZPUKIDSROhNOlN7wyCwNNS8WuqZiScmlrECs93BoOyhq4361aL2lcyzS6 tG/yiMzYMmAnU/6uDZrsAJDCPuahqvrkAoSW6rw98/inEcE9OaVMbvz7uxRszgsb LsSEM4LZGkkVphHnXLRvVGwORgcIspdXup+5MYGG7MZmphDSQVLm2y/NW08zdwWM DlKTNtCvyYlKfbqG8ALJRFGyCDlnh/PuNTcRrjt5WTcL6abqUs26igNNuTCG8BhV n78z4RzNozGLipPnGNC9oRadrQUgJEeautqK6TGymyeNnaLi5PnmPM2lPmVXSF1t liMuMZhUcyFcNrLkOn4IRlOaXdHh+RQdtK4Q2DcO8upZS2l7by8zSM3BVSwaJhTG mKZfAv3rIwhwVAFdmORJ/JTAGRo9lUf7qkYP9wAIGVClY3Xn1coezD+nbeecPJUk dojUkMdOma6MXs5bIRPXMofkRbnXJENdX1wefsXdr3GjAIf5PqF4Uybcgl4DCr9s 1yVv252cIxA=fC4O -----END PGP SIGNATURE----- -- RHSA-announce mailing list
An update for yajl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: yajl security update Advisory ID: RHSA-2022:7524-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:7524 Issue date: 2022-11-08 CVE Names: CVE-2022-24795 ==================================================================== 1. Summary: An update for yajl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C and a small validating JSON generator. Security Fix(es): * yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes thechanges described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2072912 - CVE-2022-24795 yajl: heap-based buffer overflow when handling large inputs due to an integer overflow 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: yajl-2.1.0-11.el8.src.rpm aarch64: yajl-2.1.0-11.el8.aarch64.rpm yajl-debuginfo-2.1.0-11.el8.aarch64.rpm yajl-debugsource-2.1.0-11.el8.aarch64.rpm ppc64le: yajl-2.1.0-11.el8.ppc64le.rpm yajl-debuginfo-2.1.0-11.el8.ppc64le.rpm yajl-debugsource-2.1.0-11.el8.ppc64le.rpm s390x: yajl-2.1.0-11.el8.s390x.rpm yajl-debuginfo-2.1.0-11.el8.s390x.rpm yajl-debugsource-2.1.0-11.el8.s390x.rpm x86_64: yajl-2.1.0-11.el8.i686.rpm yajl-2.1.0-11.el8.x86_64.rpm yajl-debuginfo-2.1.0-11.el8.i686.rpm yajl-debuginfo-2.1.0-11.el8.x86_64.rpm yajl-debugsource-2.1.0-11.el8.i686.rpm yajl-debugsource-2.1.0-11.el8.x86_64.rpm Red Hat CodeReady Linux Builder (v. 8): aarch64: yajl-debuginfo-2.1.0-11.el8.aarch64.rpm yajl-debugsource-2.1.0-11.el8.aarch64.rpm yajl-devel-2.1.0-11.el8.aarch64.rpm ppc64le: yajl-debuginfo-2.1.0-11.el8.ppc64le.rpm yajl-debugsource-2.1.0-11.el8.ppc64le.rpm yajl-devel-2.1.0-11.el8.ppc64le.rpm s390x: yajl-debuginfo-2.1.0-11.el8.s390x.rpm yajl-debugsource-2.1.0-11.el8.s390x.rpm yajl-devel-2.1.0-11.el8.s390x.rpm x86_64: yajl-debuginfo-2.1.0-11.el8.i686.rpm yajl-debuginfo-2.1.0-11.el8.x86_64.rpm yajl-debugsource-2.1.0-11.el8.i686.rpm yajl-debugsource-2.1.0-11.el8.x86_64.rpm yajl-devel-2.1.0-11.el8.i686.rpm yajl-devel-2.1.0-11.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2022-24795 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.7_release_notes/index 8. Contact: The Red Hat security contact is . Morecontact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY2pSj9zjgjWX9erEAQhNHQ/+NmD/kowonHJ8LFS8NxvSBg7CI5R3lXw5 mInDFqY9V6giZ/6ljuvM5wPGupf0o08fYLKukbcSPHbM9niZidXNhOiE68euQT1R tWiwoNvz2cGJ5A/PorVeuTeqUz+xDUljDHenc+YKpVHGx6+OjSTLL+CT0plpcy2d APJOAa8s4ta+7lBGw3DYyQZkPNcgFdJYRsw9BGtDPkNjpnfsWKTCErvpbKmINaAO iavmeVlSUqiPzuMu2Xez15NMGdbiTgqi5hJ/KhPjRAbqrvFFhewEmiFszyjuUlGs XAvAO2vBB8L2uZH4x6RnijBfouvWZbT1mAbh+goE6eVKJRf/F5kAG+ZYG48le9fh gFNBltaqCqeergu8g1/rsbHfwacpAjkkIookrK/QMgXcn7j09mK5kuR9lGi3wo+S U/S4JnGAzHo1ytl0Flk9nIjKhf24a3BH5DDlUR3dR56OqzMJ64co/DB6RZWEWf4t mwpOgDHkrKW7JBp74nX8owLg71SM0knv2nSmhla4hL0fEd7q+W+Ypjc/QLSDDb0J C67zsAmcyXDz96Gpz0v2bgpMperdhJ9ggmtYIp4RlgFL0DagWQRc0FAp52GsVu9u e+c0mTlCHeoaCDumnvxs2FQtwvbFogkc5MllZ3jB+IdbQbxSbJQpGt/QkLtPauaU 9YBoCjrUFPw=nzh9 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Get the latest Linux and open source security news straight to your inbox.