CVE-2023-50268

MEDIUM EPSS 35.5%
Published Dec 13, 20232y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Dec 13, 2023 2y ago
Last Modified Jun 17, 2026 1w ago

Description

jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
35.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 3

CWE-120
CWE-121
CWE-787 Out-of-bounds Write Memory Safety

Affected Products 1

VendorProductVersionRange
jqlangjq1.7any

References 5

  • openwall.com http://www.openwall.com/lists/oss-security/2023/12/15/10
    Mailing ListPatchThird Party Advisory
  • bugs.chromium.org https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771
    Issue TrackingMailing List
  • github.com https://github.com/jqlang/jq/commit/c9a51565214eece8f1053089739aea73145bfd6b
    Patch
  • github.com https://github.com/jqlang/jq/pull/2804
    Issue TrackingPatch
  • github.com https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-442f-qc8j
    ExploitVendor Advisory

Remediation

  • openwall.com http://www.openwall.com/lists/oss-security/2023/12/15/10
    Mailing ListPatchThird Party Advisory
  • github.com https://github.com/jqlang/jq/commit/c9a51565214eece8f1053089739aea73145bfd6b
    Patch
  • github.com https://github.com/jqlang/jq/pull/2804
    Issue TrackingPatch