https://seclists.org/oss-sec/2023/q4/286: jq 1.7.1 fixes CVE-2023-50246 & CVE-2023-50268
Published Dec 15, 2023
·Updated
Affected Software
1 affected component
JQ jq
Frequently Asked Questions
1
What is the severity of CVE-2023-50246?
CVE-2023-50246 has been classified as a high severity vulnerability due to its potential for causing a heap buffer overflow.
2
What is the nature of CVE-2023-50268?
CVE-2023-50268 involves a stack buffer overflow that can occur when comparing NaN with payloads.
3
How do I fix CVE-2023-50246?
To fix CVE-2023-50246, upgrade to jq version 1.7.1 or later, which includes the security patch.
4
Is there a workaround for CVE-2023-50268?
No official workaround is provided for CVE-2023-50268, so upgrading to jq version 1.7.1 remains the recommended approach.
5
What versions of jq are affected by CVE-2023-50246 and CVE-2023-50268?
CVE-2023-50246 and CVE-2023-50268 affect versions prior to jq 1.7.1.