Integer Overflow Vulnerability in jq Package Leading to Denial of Service
Summary
CVE-2024-23337: jq is a command-line JSON processor. Affects jq across 2 version ranges.
< 1.8.0-r0
< de21386681c0df0104a99d9d09db23a9b2a78b1e
Fixed in 1.8.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jq is a command-line JSON processor widely used for parsing and manipulating JSON data. It provides a powerful and flexible way to handle JSON structures through a simple syntax. The package is integral for developers and system administrators who need to work with JSON data in various applications. However, versions up to and including 1.7.1 are susceptible to an integer overflow vulnerability that can lead to denial of service, making it critical for users to be aware of this issue.
Vulnerability Detail
The vulnerability arises from an integer overflow when assigning a value using an index of 2147483647, which is the signed integer limit. This overflow can cause unexpected behavior and ultimately lead to a denial of service, where the application may crash or become unresponsive. The issue has been documented in the commit de21386681c0df0104a99d9d09db23a9b2a78b1e, which contains a patch to address the problem.
How To Fix
Minimum fixed version
1.8.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade jqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the index value of 2147483647 in their jq commands to prevent triggering the overflow. However, this is not a permanent solution, and updating the package is strongly recommended.
Conclusion
The integer overflow vulnerability in jq poses a significant risk of denial of service for users of versions up to and including 1.7.1. It is crucial to update to a patched version to ensure the security and stability of applications relying on jq for JSON processing. Users can also utilize Vulert to monitor their applications for vulnerabilities without needing to install additional software.
See every vulnerability recorded for jq →
FAQ
jq is a command-line tool for processing JSON data, allowing users to filter, transform, and manipulate JSON structures easily.
The integer overflow vulnerability occurs when an index value of 2147483647 is used, leading to unexpected behavior and potential denial of service.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, a patch is available in versions of jq after 1.7.1. Users should update their jq package to the latest version to apply the fix.
If immediate updates are not possible, avoid using the index value of 2147483647 in your jq commands as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for jq.
