CVE-2023-50246

MEDIUM EPSS 39.9%
Published Dec 13, 20232y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Dec 13, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
39.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 3

CWE-120
CWE-122
CWE-787 Out-of-bounds Write Memory Safety

Affected Products 3

VendorProductVersionRange
jqlangjq1.7any
jqlangjq1.7any
jqlangjq1.7any

References 4

  • openwall.com http://www.openwall.com/lists/oss-security/2023/12/15/10
    Mailing ListPatchThird Party Advisory
  • bugs.chromium.org https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574
    Mailing List
  • github.com https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297
    Patch
  • github.com https://github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vc
    ExploitVendor Advisory

Remediation

  • openwall.com http://www.openwall.com/lists/oss-security/2023/12/15/10
    Mailing ListPatchThird Party Advisory
  • github.com https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297
    Patch