Buffer Overflow Vulnerability in jq Package - CVE-2023-50268
Summary
ALPINE-CVE-2023-50268: jq is a command-line JSON processor. Affects jq versions < 1.7.1-r0. Fixed in 1.7.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
jq is a powerful command-line JSON processor widely used for parsing and manipulating JSON data. It allows users to filter, transform, and format JSON data efficiently. The package is known for its flexibility and speed, making it a popular choice among developers. However, certain builds of jq, specifically version 1.7, have been found to be vulnerable to a stack-based buffer overflow, which can lead to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2023-50268 affects jq version 1.7, which contains a stack-based buffer overflow in builds that utilize decNumber. This flaw can be exploited by attackers to execute arbitrary code, potentially compromising the system's integrity and confidentiality. The vulnerability arises from improper handling of input data, allowing for buffer overflow conditions that can be triggered during normal operations.
How To Fix
Minimum fixed version
1.7.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade jqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using builds of jq that utilize decNumber until the package is updated. Additionally, validating and sanitizing input data before processing it with jq can help mitigate the risk of exploitation.
Conclusion
In summary, CVE-2023-50268 represents a significant vulnerability in the jq package, specifically affecting version 1.7. Users are strongly advised to update to version 1.7.1-r0 or later to mitigate the risks associated with this buffer overflow issue. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for jq →
FAQ
CVE-2023-50268 is a vulnerability in the jq package that allows for a stack-based buffer overflow, potentially leading to arbitrary code execution.
Versions of jq prior to 1.7.1-r0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2023-50268 is 5.5, indicating a moderate level of severity.
If you cannot update jq right away, consider using input validation and avoiding builds that utilize decNumber as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for jq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
