RubyGems/yajl-ruby CVE-2022-24795: medium 5.9, EPSS 3.47%
Buffer Overflow in yajl-ruby
Action: Upgrade yajl-ruby to 1.4.3 or later.
bundle update yajl-rubyAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.4.3 | - |
Fixed versions
| 1.4.3 |
Sources
- osv: GHSA-jj47-x69x-mxrm
- https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
- https://nvd.nist.gov/vuln/detail/CVE-2022-24795
- https://github.com/brianmario/yajl-ruby/commit/7168bd79b888900aa94523301126f968a93eb3a6
- https://github.com/brianmario/yajl-ruby
- https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yajl-ruby/CVE-2022-24795.yml
- https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00003.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KLE3C4CECEJ4EUYI56KXI6OWACWXX7WN
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YO32YDJ74DADC7CMJNLSLBVWN5EXGF5J
CVE-2022-24795 · published · modified · JSON