The version of yajl installed on the remote host is prior to 2.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2101 advisory.

    yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3492 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3492-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     July 11, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : yajl     Version        : 2.1.0-3+deb10u2     CVE ID         : CVE-2017-16516 CVE-2022-24795 CVE-2023-33460     Debian Bug     : 1040036

    Multiple vulnerabilties have been found in yajl, a JSON parser / small     validating JSON generator# written in ANSI C, which potentially can     cause memory corruption or DoS.

    The CVE-20117-16516 had been addressed already in DLA-3478, however the     fix has been found to be incomplete as it missed an additional memory     leak.  This update fixes that problem.

    CVE-2017-16516

      When a crafted JSON file is supplied to yajl, the process might       crash with a SIGABRT in the yajl_string_decode function in       yajl_encode.c. This results potentially in a denial of service.

    CVE-2022-24795

      The 1.x branch and the 2.x branch of `yajl` contain an integer       overflow which leads to subsequent heap memory corruption when dealing       with large (~2GB) inputs.

    CVE-2023-33460

      There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse       function, which potentially cause out-of-memory in server and cause       crash.

    For Debian 10 buster, these problems have been fixed in version     2.1.0-3+deb10u2.

    We recommend that you upgrade your yajl packages.

    For the detailed security status of yajl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/yajl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6233-1 advisory.

    It was discovered that YAJL was not properly performing bounds checks when decoding a string with escape     sequences. If a user or automated system using YAJL were tricked into processing specially crafted input,     an attacker could possibly use this issue to cause a denial of service (application abort).
    (CVE-2017-16516)

    It was discovered that YAJL was not properly handling memory allocation when dealing with large inputs,     which could lead to heap memory corruption. If a user or automated system using YAJL were tricked into     running a specially crafted large input, an attacker could possibly use this issue to cause a denial of     service. (CVE-2022-24795)

    It was discovered that memory leaks existed in one of the YAJL parsing functions. An attacker could     possibly use this issue to cause a denial of service (memory exhaustion). (CVE-2023-33460)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0187 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-24795:
    yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL.

    CVE-2023-33460:
    There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
177847	Amazon Linux 2 : yajl (ALAS-2023-2101)	Nessus	Amazon Linux Local Security Checks	2023/7/1	2024/12/11	high
178173	Debian dla-3492 : libyajl-dev - security update	Nessus	Debian Local Security Checks	2023/7/11	2025/1/22	high
178443	Ubuntu 16.04 ESM / 18.04 ESM : YAJL vulnerabilities (USN-6233-1)	Nessus	Ubuntu Local Security Checks	2023/7/18	2024/8/27	high
235971	Alibaba Cloud Linux 3 : 0187: yajl (ALINUX3-SA-2024:0187)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high

检测

插件搜索

high

high

high

high