CVE-2023-33460 Denial of service in n/a

Medium 6.5 Published 6 Jun 2023 Updated 8 Jan 2025

A memory leak in the YAJL library's tree parsing function can cause out-of-memory conditions and server crashes, leading to denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-33460?

CVE-2023-33460 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 6 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.

Weakness: CWE-401

Which versions are affected by CVE-2023-33460?

1 open source package ship an affected version, including jsonlite. It affects 3 products.

Package	Affected	Fixed in
`jsonlite` CRAN	From `0.9.12`	`1.8.8`

Linux distribution packages (37)

`yajl` AlmaLinux:8	All versions	`2.1.0-12.el8`
`yajl-devel` AlmaLinux:8	All versions	`2.1.0-12.el8`
`yajl` AlmaLinux:9	All versions	`2.1.0-22.el9`
`yajl-devel` AlmaLinux:9	All versions	`2.1.0-22.el9`
`yajl` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.1.0-12.el8`
`yajl-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.1.0-12.el8`
`yajl-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.1.0-12.el8`
`yajl-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`0:2.1.0-12.el8`
`yajl-debugsource` Red Hat:enterprise_linux:8::crb	All versions	`0:2.1.0-12.el8`
`yajl-devel` Red Hat:enterprise_linux:8::crb	All versions	`0:2.1.0-12.el8`
`yajl` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.1.0-22.el9`
`yajl-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.1.0-22.el9`
`yajl-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.1.0-22.el9`
`yajl-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:2.1.0-22.el9`
`yajl-debugsource` Red Hat:enterprise_linux:9::crb	All versions	`0:2.1.0-22.el9`
`yajl-devel` Red Hat:enterprise_linux:9::crb	All versions	`0:2.1.0-22.el9`
`yajl` Red Hat:rhel_eus:8.8::appstream	All versions	`0:2.1.0-12.el8_8`
`yajl-debuginfo` Red Hat:rhel_eus:8.8::appstream	All versions	`0:2.1.0-12.el8_8`
`yajl-debugsource` Red Hat:rhel_eus:8.8::appstream	All versions	`0:2.1.0-12.el8_8`
`yajl-debuginfo` Red Hat:rhel_eus:8.8::crb	All versions	`0:2.1.0-12.el8_8`
`yajl-debugsource` Red Hat:rhel_eus:8.8::crb	All versions	`0:2.1.0-12.el8_8`
`yajl-devel` Red Hat:rhel_eus:8.8::crb	All versions	`0:2.1.0-12.el8_8`
`yajl` Rocky Linux:8	All versions	`0:2.1.0-12.el8`
`yajl` Rocky Linux:9	All versions	`0:2.1.0-22.el9`
`libyajl` SUSE:Linux Enterprise Micro 5.1	All versions	`2.1.0-150000.4.6.1`
`libyajl` SUSE:Linux Enterprise Micro 5.2	All versions	`2.1.0-150000.4.6.1`
`libyajl` SUSE:Linux Enterprise Micro 5.3	All versions	`2.1.0-150000.4.6.1`
`libyajl` SUSE:Linux Enterprise Micro 5.4	All versions	`2.1.0-150000.4.6.1`
`libyajl` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`2.1.0-150000.4.6.1`
`libyajl` SUSE:Linux Enterprise Module for Basesystem 15 SP5	All versions	`2.1.0-150000.4.6.1`
`libyajl` SUSE:Linux Enterprise Real Time 15 SP3	All versions	`2.1.0-150000.4.6.1`
`libyajl` SUSE:Manager Proxy 4.2	All versions	`2.1.0-150000.4.6.1`
`libyajl` SUSE:Manager Server 4.2	All versions	`2.1.0-150000.4.6.1`
`libyajl` openSUSE:Leap 15.4	All versions	`2.1.0-150000.4.6.1`
`libyajl` openSUSE:Leap 15.5	All versions	`2.1.0-150000.4.6.1`
`libyajl` openSUSE:Leap Micro 5.3	All versions	`2.1.0-150000.4.6.1`
`libyajl` openSUSE:Leap Micro 5.4	All versions	`2.1.0-150000.4.6.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Yajl Project Yajl.

How do I fix CVE-2023-33460?

Upgrade jsonlite to 1.8.8 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-33460 being exploited?

There is no known exploitation of CVE-2023-33460 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2023-33460, ALSA-2023:6551, ALSA-2023:7057, AZL-27143, AZL-35363, BELL-CVE-2023-33460 and 16 more.