#1040159 epics-base: embedded yajl is vulnerable to CVE-2017-16516 and CVE-2022-24795

Package:
epics-base
Source:
epics-base
Description:
EPICS tools
Submitter:
Tobias Frost
Date:
2023-07-26 10:18:03 UTC
Severity:
normal
Tags:
#1040159#5
Date:
2023-07-01 11:03:38 UTC
From:
To:
Source: yajl
Severity: important
Tags: security upstream
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

After preparing the LTS upload of yajl I've seen the following issues in
the upstream github issue tracker:

CVE-2017-16516 [1] portential buffer overread: A JSON file can cause denial of
 service.

CVE-2022-24795 [2] potential integer overflow which can lead to subsequent heap
  memory corruption when dealing with large (~2GB) input

The upstream issue tracker also indicates that there might be other vulnerabilies
(without CVEs or unknown CVEs), but I did not investiage further:
https://github.com/lloyd/yajl/issues/206 (double free)
https://github.com/lloyd/yajl/issues/204 (Uninitialized memory reads and out-of-bound)

It seems that the code is unmaintained upstream. It might be a good idea to evaluate
if any of the forks are more active and whether Debian should move there.

Cheers,
#1040159#24
Date:
2023-07-26 10:07:30 UTC
From:
To:
Hello,

I dicovered that upstream modifier yajl in order to support json5.
I am wondering if their modification could not be integrated in our yajl.

I fill a burg report about this idea here

https://github.com/epics-base/epics-base/issues/405

Tell me what is your opinion about this.

Cheers

Fred