Bug 2254467 (CVE-2023-50246) - CVE-2023-50246 jq: heap buffer overflow in function decToString() in decNumber.c
Summary: CVE-2023-50246 jq: heap buffer overflow in function decToString() in decNumber.c
Keywords:
Status: NEW
Alias: CVE-2023-50246
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2254488 2254489
Blocks: 2254521
TreeView+ depends on / blocked
 
Reported: 2023-12-14 05:32 UTC by TEJ RATHI
Modified: 2024-02-28 06:19 UTC (History)
22 users (show)

Fixed In Version: jq 1.7.1
Doc Type: If docs needed, set a value
Doc Text:
A heap-based buffer overflow vulnerability was found in the decToString() function in decNumber.c in the Jq project. This issue occurs when submitting malicious input to the application, leading to an application crash and causing a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description TEJ RATHI 2023-12-14 05:32:11 UTC
jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574
https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297
https://github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vc

Comment 1 TEJ RATHI 2023-12-14 08:05:08 UTC
Created jq tracking bugs for this issue:

Affects: epel-all [bug 2254489]
Affects: fedora-all [bug 2254488]


Note You need to log in before you can comment on or make changes to this bug.