CVE catalog

CVE-2022-24795

burp: CVE-2022-24795

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.47% · Oct 25, 2026

A flaw was found in the YAJL library in the way it reallocates a memory buffer to store more data. A very large input causes the value used to calculate the buffer size to overflow, resulting in a heap-based buffer overflow. yajl: heap-based buffer overflow when handling large inputs due to an integer overflow Red Hat Enterprise Linux only ships YAJL 2.x versions and on 32-bit systems, more than 2GiB of data will be required for triggering this bug. However, on 64-bit systems, more than 9EiB of data will be needed, making this vulnerability very hard to be exploited on these systems. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianburpsid3.1.4-5fixed
Debianburptrixie3.1.4-4fixed
Debianburpbookworm3.1.4-1vulnerable
Debianyajlsid2.1.0-7fixed
Debianyajlforky2.1.0-7fixed
Debianyajltrixie2.1.0-5fixed
Debianyajlbookworm2.1.0-3+deb12u2fixed
Debianruby-yajlsid1.4.3-2fixed
Debianruby-yajlforky1.4.3-2fixed
Debianruby-yajltrixie1.4.3-1fixed
Debianruby-yajlbookworm1.4.3-1fixed
Debianepics-basesid7.0.8.1+dfsg1-10not affected
Debianepics-baseforky7.0.8.1+dfsg1-10not affected
Debianepics-basetrixie7.0.8.1+dfsg1-7+deb13u1not affected
Debianepics-basebookworm7.0.3.1-4not affected
Debianr-cran-jsonlitesid2.0.0+dfsg-2fixed
Debianr-cran-jsonliteforky2.0.0+dfsg-2fixed
Debianr-cran-jsonlitetrixie1.9.1+dfsg-1fixed
Debianr-cran-jsonlitebookworm1.8.4+dfsg-1vulnerable
Suserubygem-yajl-rubyopenstack cloud crowbar 81.3.1-4.6.1fixed
Suserubygem-yajl-rubyopenstack cloud crowbar 91.3.1-4.6.1fixed
Suselibyajllinux enterprise software development kit 12 sp52.0.1-18.7.1fixed
Suselibyajllinux enterprise server 12 sp52.0.1-18.7.1fixed
Suselibyajllinux enterprise server for sap applications 12 sp52.0.1-18.7.1fixed
Suselibyajllinux enterprise module for basesystem 15 sp32.1.0-150000.4.3.1fixed
Suselibyajllinux enterprise module for basesystem 15 sp42.1.0-150000.4.3.1fixed
Suselibyajllinux enterprise micro 5.12.1.0-150000.4.3.1fixed
Suselibyajllinux enterprise micro 5.22.1.0-150000.4.3.1fixed
Opensuselibyajlleap micro 5.22.1.0-150000.4.3.1fixed
Opensuselibyajlleap 15.32.1.0-150000.4.3.1fixed
Opensuselibyajlleap 15.42.1.0-150000.4.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianburpsourcesid3.1.4-2not yet assignedNot reported[1040146]
Debianburpsourcetrixie3.1.4-2not yet assignedNot reported[1040146]
Debianburpsourcebookworm(unfixed)not yet assignedNot reported[1040146]
Debianyajlsourcesid2.1.0-4not yet assignedNot reported[1040036]
Debianyajlsourceforky2.1.0-4not yet assignedNot reported[1040036]
Debianyajlsourcetrixie2.1.0-4not yet assignedNot reported[1040036]
Debianyajlsourcebookworm2.1.0-3+deb12u2not yet assignedNot reported[1040036]
Debianruby-yajlsourcesid1.4.3-1not yet assignedNot reported[1014803]
Debianruby-yajlsourceforky1.4.3-1not yet assignedNot reported[1014803]
Debianruby-yajlsourcetrixie1.4.3-1not yet assignedNot reported[1014803]
Debianruby-yajlsourcebookworm1.4.3-1not yet assignedNot reported[1014803]
Debianepics-basesourcesidNot affectedunimportantNot reportedNot reported
Debianepics-basesourceforkyNot affectedunimportantNot reportedNot reported
Debianepics-basesourcetrixieNot affectedunimportantNot reportedNot reported
Debianepics-basesourcebookwormNot affectedunimportantNot reportedNot reported
Debianr-cran-jsonlitesourcesid1.8.8+dfsg-1not yet assignedNot reported[1040161]
Debianr-cran-jsonlitesourceforky1.8.8+dfsg-1not yet assignedNot reported[1040161]
Debianr-cran-jsonlitesourcetrixie1.8.8+dfsg-1not yet assignedNot reported[1040161]
Debianr-cran-jsonlitesourcebookworm(unfixed)not yet assignedNot reported[1040161]
Suserubygem-yajl-rubyrpmopenstack cloud crowbar 81.3.1-4.6.1Not reportedSUSE-SU-2022:1918-1Not reported
Suserubygem-yajl-rubyrpmopenstack cloud crowbar 91.3.1-4.6.1Not reportedSUSE-SU-2022:1918-1Not reported
Suselibyajlrpmlinux enterprise software development kit 12 sp52.0.1-18.7.1Not reportedSUSE-SU-2022:1746-1Not reported
Suselibyajlrpmlinux enterprise server 12 sp52.0.1-18.7.1Not reportedSUSE-SU-2022:1746-1Not reported
Suselibyajlrpmlinux enterprise server for sap applications 12 sp52.0.1-18.7.1Not reportedSUSE-SU-2022:1746-1Not reported
Suselibyajlrpmlinux enterprise module for basesystem 15 sp32.1.0-150000.4.3.1Not reportedSUSE-SU-2022:3162-1Not reported
Suselibyajlrpmlinux enterprise module for basesystem 15 sp42.1.0-150000.4.3.1Not reportedSUSE-SU-2022:3162-1Not reported
Suselibyajlrpmlinux enterprise micro 5.12.1.0-150000.4.3.1Not reportedSUSE-SU-2022:3162-1Not reported
Suselibyajlrpmlinux enterprise micro 5.22.1.0-150000.4.3.1Not reportedSUSE-SU-2022:3162-1Not reported
Opensuselibyajlrpmleap micro 5.22.1.0-150000.4.3.1Not reportedSUSE-SU-2022:3162-1Not reported
Opensuselibyajlrpmleap 15.32.1.0-150000.4.3.1Not reportedSUSE-SU-2022:3162-1Not reported
Opensuselibyajlrpmleap 15.42.1.0-150000.4.3.1Not reportedSUSE-SU-2022:3162-1Not reported

[Debian bug #1040146][Debian bug #1040036][Debian bug #1014803][Debian bug #1040161]

Notes

[bookworm] burp: Minor issue [bookworm] r-cran-jsonlite: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [burp]Affected
    Details (2)

    • 3.1.4-1 · amd64 · bookworm

      Affected

      dsa · burp · debian · bookworm

    • 3.1.4-1 · arm64 · bookworm

      Affected

      dsa · burp · debian · bookworm

  • [r-cran-jsonlite]Affected
    Details (2)

    • 1.8.4+dfsg-1 · amd64 · bookworm

      Affected

      dsa · r-cran-jsonlite · debian · bookworm

    • 1.8.4+dfsg-1 · arm64 · bookworm

      Affected

      dsa · r-cran-jsonlite · debian · bookworm

  • [libca4.13.5]Not affected

    Source package: [epics-base]

    Details (1)

    • 7.0.3.1-4 · amd64 · bookworm

      Not affected

      dsa · epics-base · debian · bookworm

  • [libca-dev]Not affected

    Source package: [epics-base]

    Details (1)

    • 7.0.3.1-4 · amd64 · bookworm

      Not affected

      dsa · epics-base · debian · bookworm

  • [libcom3.17.6]Not affected

    Source package: [epics-base]

    Details (1)

    • 7.0.3.1-4 · amd64 · bookworm

      Not affected

      dsa · epics-base · debian · bookworm

  • [libcom-dev]Not affected

    Source package: [epics-base]

    Details (1)

    • 7.0.3.1-4 · amd64 · bookworm

      Not affected

      dsa · epics-base · debian · bookworm

  • [libyajl2]Fixed

    Source package: [yajl]

    Details (2)

    • 2.1.0-3+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.1.0-3+deb12u2

      dsa · yajl · debian · bookworm

    • 2.1.0-3+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.1.0-3+deb12u2

      dsa · yajl · debian · bookworm

  • [libyajl-dev]Fixed

    Source package: [yajl]

    Details (2)

    • 2.1.0-3+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.1.0-3+deb12u2

      dsa · yajl · debian · bookworm

    • 2.1.0-3+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.1.0-3+deb12u2

      dsa · yajl · debian · bookworm

  • [libyajl-doc]Fixed

    Source package: [yajl]

    Details (2)

    • 2.1.0-3+deb12u2 · all · bookworm

      Fixed · Fixed: 2.1.0-3+deb12u2

      dsa · yajl · debian · bookworm

    • 2.1.0-3+deb12u2 · all · bookworm

      Fixed · Fixed: 2.1.0-3+deb12u2

      dsa · yajl · debian · bookworm

  • [ruby-yajl]Fixed

    Source package: [ruby-yajl]

    Details (2)

    • 1.4.3-1+b2 · amd64 · bookworm

      Fixed · Fixed: 1.4.3-1

      dsa · ruby-yajl · debian · bookworm

    • 1.4.3-1+b2 · arm64 · bookworm

      Fixed · Fixed: 1.4.3-1

      dsa · ruby-yajl · debian · bookworm

  • [yajl-tools]Fixed

    Source package: [yajl]

    Details (2)

    • 2.1.0-3+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.1.0-3+deb12u2

      dsa · yajl · debian · bookworm

    • 2.1.0-3+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.1.0-3+deb12u2

      dsa · yajl · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]