Headline
RHSA-2022:7524: Red Hat Security Advisory: yajl security update
An update for yajl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2022-24795: yajl: heap-based buffer overflow when handling large inputs due to an integer overflow
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Virtualization
- Red Hat Identity Management
- Red Hat Directory Server
- Red Hat Certificate System
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Update Infrastructure
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat CloudForms
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- Red Hat CodeReady Workspaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Thorntail
- Red Hat build of Eclipse Vert.x
- Red Hat build of OpenJDK
- Red Hat build of Quarkus
Integration and Automation
- Red Hat Process Automation
- Red Hat Process Automation Manager
- Red Hat Decision Manager
All Products
Issued:
2022-11-08
Updated:
2022-11-08
RHSA-2022:7524 - Security Advisory
- Overview
- Updated Packages
Synopsis
Moderate: yajl security update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for yajl is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C and a small validating JSON generator.
Security Fix(es):
- yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes linked from the References section.
Affected Products
- Red Hat Enterprise Linux for x86_64 8 x86_64
- Red Hat Enterprise Linux for IBM z Systems 8 s390x
- Red Hat Enterprise Linux for Power, little endian 8 ppc64le
- Red Hat Enterprise Linux for ARM 64 8 aarch64
- Red Hat CodeReady Linux Builder for x86_64 8 x86_64
- Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
- Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
- Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x
Fixes
- BZ - 2072912 - CVE-2022-24795 yajl: heap-based buffer overflow when handling large inputs due to an integer overflow
References
- https://access.redhat.com/security/updates/classification/#moderate
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index
Red Hat Enterprise Linux for x86_64 8
SRPM
yajl-2.1.0-11.el8.src.rpm
SHA-256: 497ad345108f8f357b7183b8517b9da39994f27a59ee211ed474a7ea69cf9e09
x86_64
yajl-2.1.0-11.el8.i686.rpm
SHA-256: 56f77b3a69dcafe3c09cea69cf41f0c2b23a9abf13ace212e9a46c0c3fc06a10
yajl-2.1.0-11.el8.x86_64.rpm
SHA-256: a89b2a6ecbc02e44a47d1d39d6bb722d51215d91b6a4e540cd31012e9e114fb5
yajl-debuginfo-2.1.0-11.el8.i686.rpm
SHA-256: f0e0265dc64d18ced363da93893b44c7f70a0bb14c8de23187e6dfefa0d48c48
yajl-debuginfo-2.1.0-11.el8.x86_64.rpm
SHA-256: 5e21c815d100df3e3452b61573c1142064bfe45fe14352b4f03e7327e0ec7e4d
yajl-debugsource-2.1.0-11.el8.i686.rpm
SHA-256: c5adce8707c7feb2bb0a4cd26bfaaea4cef9dbbd6b06294f7bf1fbfec7f43acd
yajl-debugsource-2.1.0-11.el8.x86_64.rpm
SHA-256: 45d46e138230d6112592bdab6ae44832c12b6e0cbaf053c645f48cb902c22915
Red Hat Enterprise Linux for IBM z Systems 8
SRPM
yajl-2.1.0-11.el8.src.rpm
SHA-256: 497ad345108f8f357b7183b8517b9da39994f27a59ee211ed474a7ea69cf9e09
s390x
yajl-2.1.0-11.el8.s390x.rpm
SHA-256: 008e0c136ec6fdd582e789dc9be32b54f47536c57d71b0bfff001372b180cede
yajl-debuginfo-2.1.0-11.el8.s390x.rpm
SHA-256: 84b0140f03f5f3dfc6b1561a9e8185e1a8a21ae39d25a8d223c903d484ac635d
yajl-debugsource-2.1.0-11.el8.s390x.rpm
SHA-256: 6b4d54f9a239a8620d7240744ef789fe8796722ceaa791cddbf9b2c5dcd02341
Red Hat Enterprise Linux for Power, little endian 8
SRPM
yajl-2.1.0-11.el8.src.rpm
SHA-256: 497ad345108f8f357b7183b8517b9da39994f27a59ee211ed474a7ea69cf9e09
ppc64le
yajl-2.1.0-11.el8.ppc64le.rpm
SHA-256: e1e74761375aad1f52cd61a4a29e70b845f80b44cf21314456bcca6c96ef435c
yajl-debuginfo-2.1.0-11.el8.ppc64le.rpm
SHA-256: e58f08377a80067c92463452d20cce36ef84986cdca874a59bf5404c01b7d95c
yajl-debugsource-2.1.0-11.el8.ppc64le.rpm
SHA-256: 0b9733b55ebf6613ad2b79556bebfeb9459323bfc201c338c36ac142aadc174d
Red Hat Enterprise Linux for ARM 64 8
SRPM
yajl-2.1.0-11.el8.src.rpm
SHA-256: 497ad345108f8f357b7183b8517b9da39994f27a59ee211ed474a7ea69cf9e09
aarch64
yajl-2.1.0-11.el8.aarch64.rpm
SHA-256: c7f39ffd0ef47e8e44df4093a6c8d17adb2ba7e5a05e9d84bbe8d34e2d48268b
yajl-debuginfo-2.1.0-11.el8.aarch64.rpm
SHA-256: 58e6ba76c6ab8f8c42b434e62b530f6f3ebaae72fdbeb3596d00d7cc3529c944
yajl-debugsource-2.1.0-11.el8.aarch64.rpm
SHA-256: 8303ddb7c7145e63604a71b1fd3d2e4cb3af36f3687f1cb34880fcd6f6371b64
Red Hat CodeReady Linux Builder for x86_64 8
SRPM
x86_64
yajl-debuginfo-2.1.0-11.el8.i686.rpm
SHA-256: f0e0265dc64d18ced363da93893b44c7f70a0bb14c8de23187e6dfefa0d48c48
yajl-debuginfo-2.1.0-11.el8.x86_64.rpm
SHA-256: 5e21c815d100df3e3452b61573c1142064bfe45fe14352b4f03e7327e0ec7e4d
yajl-debugsource-2.1.0-11.el8.i686.rpm
SHA-256: c5adce8707c7feb2bb0a4cd26bfaaea4cef9dbbd6b06294f7bf1fbfec7f43acd
yajl-debugsource-2.1.0-11.el8.x86_64.rpm
SHA-256: 45d46e138230d6112592bdab6ae44832c12b6e0cbaf053c645f48cb902c22915
yajl-devel-2.1.0-11.el8.i686.rpm
SHA-256: 0e90b452836d9908d446a74403ac38a0238db340c20d0826272b634bde3e4da9
yajl-devel-2.1.0-11.el8.x86_64.rpm
SHA-256: 5f41177eb111d121dcd11f7ef50a32f4fb0a7c0d3abb072870f9dd8ef7dcf170
Red Hat CodeReady Linux Builder for Power, little endian 8
SRPM
ppc64le
yajl-debuginfo-2.1.0-11.el8.ppc64le.rpm
SHA-256: e58f08377a80067c92463452d20cce36ef84986cdca874a59bf5404c01b7d95c
yajl-debugsource-2.1.0-11.el8.ppc64le.rpm
SHA-256: 0b9733b55ebf6613ad2b79556bebfeb9459323bfc201c338c36ac142aadc174d
yajl-devel-2.1.0-11.el8.ppc64le.rpm
SHA-256: c6468febfed719b2ca33316595582098073bb16d006ba91a808b494042babc38
Red Hat CodeReady Linux Builder for ARM 64 8
SRPM
aarch64
yajl-debuginfo-2.1.0-11.el8.aarch64.rpm
SHA-256: 58e6ba76c6ab8f8c42b434e62b530f6f3ebaae72fdbeb3596d00d7cc3529c944
yajl-debugsource-2.1.0-11.el8.aarch64.rpm
SHA-256: 8303ddb7c7145e63604a71b1fd3d2e4cb3af36f3687f1cb34880fcd6f6371b64
yajl-devel-2.1.0-11.el8.aarch64.rpm
SHA-256: c790312ac126363af7540657a24de93ac30b35dddef4d005b63a9959ebfa61e3
Red Hat CodeReady Linux Builder for IBM z Systems 8
SRPM
s390x
yajl-debuginfo-2.1.0-11.el8.s390x.rpm
SHA-256: 84b0140f03f5f3dfc6b1561a9e8185e1a8a21ae39d25a8d223c903d484ac635d
yajl-debugsource-2.1.0-11.el8.s390x.rpm
SHA-256: 6b4d54f9a239a8620d7240744ef789fe8796722ceaa791cddbf9b2c5dcd02341
yajl-devel-2.1.0-11.el8.s390x.rpm
SHA-256: 7bbaa38b251526d90400cf278e25490b7138f3a3b91326bf6b73ede7f969f4ad
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
Red Hat Security Advisory 2024-2063-03 - An update for yajl is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Issues addressed include buffer overflow, integer overflow, and memory leak vulnerabilities.
Ubuntu Security Notice 6233-2 - USN-6233-1 fixed vulnerabilities in YAJL. This update provides the corresponding updates for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. It was discovered that YAJL was not properly performing bounds checks when decoding a string with escape sequences. If a user or automated system using YAJL were tricked into processing specially crafted input, an attacker could possibly use this issue to cause a denial of service .
Ubuntu Security Notice 6233-1 - It was discovered that YAJL was not properly performing bounds checks when decoding a string with escape sequences. If a user or automated system using YAJL were tricked into processing specially crafted input, an attacker could possibly use this issue to cause a denial of service. It was discovered that YAJL was not properly handling memory allocation when dealing with large inputs, which could lead to heap memory corruption. If a user or automated system using YAJL were tricked into running a specially crafted large input, an attacker could possibly use this issue to cause a denial of service.
Red Hat Security Advisory 2023-0408-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. Issues addressed include denial of service and out of bounds read vulnerabilities.
Red Hat OpenShift Virtualization release 4.12 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS * CVE-2021-44716: golang: net/http: limit growth of header canonicalization cache * CVE-2021-44717: golang: syscall: don't close fd 0 on ForkExec error * CVE-2022-1705: golang: net/http: improper sanitizat...
Red Hat Security Advisory 2022-8750-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. Issues addressed include denial of service and out of bounds read vulnerabilities.
Red Hat OpenShift Virtualization release 4.11.1 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS * CVE-2022-24675: golang: encoding/pem: fix stack overflow in Decode * CVE-2022-24921: golang: regexp: stack exhaustion via a deeply nested expression * CVE-2022-28327: golang: crypto/elliptic: panic caus...
An update for yajl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-24795: yajl: heap-based buffer overflow when handling large inputs due to an integer overflow
yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available an...