Описание
jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.
A flaw was found in jq, a command-line JSON processor. An attacker can exploit an integer overflow vulnerability by crafting queries that produce extremely large strings. This causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, leading to a drastically undersized memory buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap-based buffer overflow. This can result in a Denial of Service (DoS) by crashing the process or potentially allow for further exploitation through heap corruption.
Отчет
This Moderate impact vulnerability in jq, a command-line JSON processor, allows for a Denial of Service or potential arbitrary code execution. The flaw occurs when jq processes untrusted queries that generate excessively large strings, leading to an integer overflow and heap-based buffer overflow. Red Hat products that utilize jq for processing JSON data are affected if they handle untrusted jq queries.
Меры по смягчению последствий
To mitigate this issue, avoid processing untrusted or unvalidated JSON input with the jq utility. Ensure that any scripts or automated processes utilizing jq only operate on trusted data sources. Restricting the execution of jq to trusted users and environments can also reduce exposure.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | automation-controller | Fix deferred | ||
| Red Hat Ansible Automation Platform 2 | redhat-user-workloads/controller-rhel9 | Fix deferred | ||
| Red Hat Ansible Automation Platform 2 | redhat-user-workloads/hub-rhel9 | Fix deferred | ||
| Red Hat Ceph Storage 4 | jq | Fix deferred | ||
| Red Hat Enterprise Linux 10 | jq | Fix deferred | ||
| Red Hat Enterprise Linux 8 | jq | Fix deferred | ||
| Red Hat Enterprise Linux 9 | jq | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred | ||
| Red Hat Hardened Images | jq-main-1.8.1-3.hum1 | Fixed | RHSA-2026:8579 | 16.04.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6...
jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab
jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow
jq is a command-line JSON processor. An integer overflow vulnerability ...
Уязвимость функций jvp_string_append() и jvp_string_copy_replace_bad() утилиты для обработки JSON-файлов jq, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
6.8 Medium
CVSS3