Critical Stack Buffer Overflow in jq Package - CVE-2024-53427
Summary
CVE-2024-53427: decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp... Affects jq across 2 version ranges.
< 1.8.0-r0
< 71c2ab509a8628dbbad4bc7b3f98a64aa90d3297
Fixed in 1.8.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jq is a lightweight and flexible command-line JSON processor that allows users to slice, filter, map, and transform structured data effortlessly. It is widely used in various applications for handling JSON data due to its powerful querying capabilities. However, the version 1.7.1 of jq has been identified to contain a critical vulnerability that could lead to severe security risks.
Vulnerability Detail
CVE-2024-53427 is a stack-buffer-overflow vulnerability found in the decNumberCopy function within decNumber.c of jq version 1.7.1. This flaw allows attackers to exploit the buffer overflow, potentially leading to arbitrary code execution or crashes. The vulnerability arises from improper handling of memory allocation, which can be triggered by specially crafted inputs, making it a significant threat to systems utilizing this version of jq.
How To Fix
Minimum fixed version
1.8.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade jqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using jq version 1.7.1 until they can upgrade to a secure version. Additionally, validating and sanitizing input data before processing it with jq may help mitigate the risk of exploitation.
Conclusion
The vulnerability CVE-2024-53427 in jq version 1.7.1 poses a significant security risk due to a stack-buffer-overflow issue. Users are strongly advised to update to a patched version to protect their systems. Temporary workarounds can help mitigate risks until an update can be applied.
See every vulnerability recorded for jq →
FAQ
CVE-2024-53427 is a vulnerability in jq version 1.7.1 that allows for a stack-buffer-overflow, potentially leading to arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to arbitrary code execution, crashes, and unauthorized access to sensitive data.
Yes, a patched version of jq is available. Users should update to a version later than 1.7.1 to mitigate the risk.
If immediate updating is not possible, consider validating and sanitizing inputs to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for jq.
