Bug 2367807 (CVE-2024-23337)

Summary: CVE-2024-23337 jq: jq has signed integer overflow in jv.c:jvp_array_write
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adudiak, amctagga, aoconnor, bniver, crizzo, flucifre, gmeno, haoli, hkataria, jajackso, jcammara, jmitchel, jneedle, jtanner, kegrant, koliveir, kshier, mabashia, mbenjamin, mhackett, omaciel, pbraun, shvarugh, simaishi, smcdonal, sostapov, stcannon, teagle, tfister, thavo, vereddy, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in jq, a command line JSON processor. An integer overflow can occur when attempting to assign a value using an array index of 2147483647 or when creating an array with 2147483647 elements, the maximum value for a 32-bit signed integer. This issue causes out-of-bounds memory access and results in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2370297, 2370298    
Bug Blocks:    

Description OSIDB Bzimport 2025-05-21 15:01:17 UTC 
jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.