In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6233-2 advisory.

    USN-6233-1 fixed vulnerabilities in YAJL. This update provides the corresponding updates for Ubuntu 20.04     LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3516 advisory.

  - In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the     whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This     results in the whole ruby process terminating and potentially a denial of service. (CVE-2017-16516)

  - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6233-1 advisory.

    It was discovered that YAJL was not properly performing bounds checks when decoding a string with escape     sequences. If a user or automated system using YAJL were tricked into processing specially crafted input,     an attacker could possibly use this issue to cause a denial of service (application abort).
    (CVE-2017-16516)

    It was discovered that YAJL was not properly handling memory allocation when dealing with large inputs,     which could lead to heap memory corruption. If a user or automated system using YAJL were tricked into     running a specially crafted large input, an attacker could possibly use this issue to cause a denial of     service. (CVE-2022-24795)

    It was discovered that memory leaks existed in one of the YAJL parsing functions. An attacker could     possibly use this issue to cause a denial of service (memory exhaustion). (CVE-2023-33460)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3492 advisory.

  - In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the     whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This     results in the whole ruby process terminating and potentially a denial of service. (CVE-2017-16516)

  - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability was found in ruby-yajl, an interface to Yajl, a JSON stream-based parser library. When a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This may result in a denial of service.

For Debian 7 'Wheezy', these problems have been fixed in version 1.1.0-2+deb7u1.

We recommend that you upgrade your ruby-yajl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
186986	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : YAJL vulnerabilities (USN-6233-2)	Nessus	Ubuntu Local Security Checks	high
179386	Debian DLA-3516-1 : burp - LTS security update	Nessus	Debian Local Security Checks	high
178443	Ubuntu 16.04 ESM / 18.04 ESM : YAJL vulnerabilities (USN-6233-1)	Nessus	Ubuntu Local Security Checks	high
178173	Debian DLA-3492-1 : yajl - LTS security update	Nessus	Debian Local Security Checks	high
104464	Debian DLA-1167-1 : ruby-yajl security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-16516

high

Tenable Plugins

high

high

high

high

high