PT-2023-6791 · Yajl+11 · Yajl+11

Notmebutwind · Published 2023-05-08 · Updated 2026-03-29 · CVE-2023-33460

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions yajl version 2.1.0

Description The issue is related to a memory leak caused by the use of the yajl tree parse function in the yajl library. This can lead to out-of-memory conditions in servers, resulting in crashes. The vulnerability can be exploited by remote attackers to cause a denial of service.

Recommendations For yajl version 2.1.0, consider disabling the yajl tree parse function as a temporary workaround until a patch is available. Restricting the use of this function can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALSA-2023:6551

ALSA-2023:7057

ALT-PU-2023-1991

ALT-PU-2023-2005

ALT-PU-2023-2007

ALT-PU-2023-2013

ALT-PU-2023-4612

AZL-27143

AZL-35363

BDU:2023-07652

CESA-2023_7057

CVE-2023-33460

DLA-3478-1

DLA-3492-1

DLA-3516-1

INFSA-2023_6551

MGASA-2024-0066

OPENSUSE-SU-2023_3301-1

OPENSUSE-SU-2024:13057-1

RHSA-2023:6551

RHSA-2023:7057

RHSA-2023_6551

RHSA-2023_7057

RHSA-2024:2063

RHSA-2024:2580

RLSA-2023:6551

RLSA-2023:7057

ROSA-SA-2024-2478

RSEC-2023-3

SUSE-SU-2023:3301-1

SUSE-SU-2023_3301-1

USN-6233-1

USN-6233-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Yajl

References · 74

• 🔥 https://github.com/lloyd/yajl/issues/250 · Exploit
• https://osv.dev/vulnerability/USN-6233-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO32YDJ74DADC7CMJNLSLBVWN5EXGF5J · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35363 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-33460 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33460 · Security Note
• https://errata.almalinux.org/8/ALSA-2023-7057.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-33460 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-33460 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3301-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3478-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:7057 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6233-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:7057 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3478 · Vendor Advisory