CVE-2024-53427

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).

References

Affected packages

Alpine:v3.22 / jq

Package

Name: jq
Purl: pkg:apk/alpine/jq?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0-r0

Affected versions

1.*

1.4-r0

1.5-r0

1.5-r1

1.5-r2

1.5-r3

1.5-r4

1.5-r5

1.6_rc1-r0

1.6_rc1-r1

1.6_rc2-r1

1.6-r0

1.6-r1

1.6-r2

1.6-r3

1.7-r0

1.7-r1

1.7-r2

1.7.1-r0

Debian:13 / jq

Package

Name: jq
Purl: pkg:deb/debian/jq?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.7.1-5

Affected versions

1.*

1.6-2.1

1.6-3

1.7-1

1.7.1-1

1.7.1-2

1.7.1-3

1.7.1-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/jqlang/jq

Affected ranges

Type: GIT
Repo: https://github.com/jqlang/jq
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

71c2ab509a8628dbbad4bc7b3f98a64aa90d3297

Affected versions

1.*

1.6rc2

jq-1.*

jq-1.0

jq-1.1

jq-1.2

jq-1.3

jq-1.4

jq-1.5rc1

jq-1.5rc2

jq-1.6

jq-1.6rc1

jq-1.7

jq-1.7.1

jq-1.7rc1

jq-1.7rc2