Описание
jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.
A flaw was found in jq. The f_strflocaltime function in builtin.c contains a heap use-after-free vulnerability, which can allow a local attacker to trigger a crash by providing a specially crafted input. This condition arises from the use of freed memory, leading to unpredictable program behavior. The vulnerability can directly result in an application level denial of service.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | automation-controller | Fix deferred | ||
| Red Hat Ceph Storage 4 | jq | Not affected | ||
| Red Hat Enterprise Linux 10 | jq | Not affected | ||
| Red Hat Enterprise Linux 8 | jq | Not affected | ||
| Red Hat Enterprise Linux 9 | jq | Not affected | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Not affected | ||
| Red Hat Trusted Application Pipeline | rhtap-cli/rhtap-cli-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.
jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.
jq is a command-line JSON processor. In version 1.8.0 a heap use after ...
Уязвимость функции f_strflocaltime() функционального языка программирования jq, позволяющая нарушителю оказать воздействие на доступность защищаемой информации
5.3 Medium
CVSS3