Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-53427: decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | jq | 0:1.7.1-49.amzn2023.0.2 |
| Amazon Linux · 2023 | jq-debuginfo | 0:1.7.1-49.amzn2023.0.2 |
| Amazon Linux · 2023 | jq-debugsource | 0:1.7.1-49.amzn2023.0.2 |
| Amazon Linux · 2023 | jq-devel | 0:1.7.1-49.amzn2023.0.2 |
Vulnerabilities 1
-
High 8.1
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which h…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-53427.html