embedded yajl is vulnerable to CVE-2017-16516 and CVE-2022-24795

[kalos]

I think that remove embedded version of yaji and make this a build requirement, is a better idea.

As suggested in a debian bugreport by Bastien Roucariès:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039085

Bugreport with more info on CVEs: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040146

[vt-alt]

jfyi: There is also unfixed CVE-2023-33460.

lloyd/yajl is unmaintained since long time.
I (just) found maintained yajl fork: https://github.com/robohack/yajl/

(Or as alternative fixing method): Patches that Fedora applies to yajl package https://src.fedoraproject.org/rpms/yajl/tree/rawhide

[grke]

Hello,
Thanks for the information.

The path of least resistance is to update the embedded yajl, which I have now done using the robohack fork above.

The Windows build does use an external yajl library, but since I produce the Windows installers, I have to update that too.
I will do that next.