Headline

CVE-2023-49355: GitHub - jqlang/jq at 88f01a741c8d63c4d1b5bc3ef61520c6eb93edaa

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input.

11 months ago

CVE

Open in Source

#js #git #docker

jq is a lightweight and flexible command-line JSON processor akin to sed,awk,grep, and friends for JSON data. It’s written in portable C and has zero runtime dependencies, allowing you to easily slice, filter, map, and transform structured data.

Documentation

Official Documentation: jqlang.github.io/jq
Try jq Online: jqplay.org

Installation****Prebuilt Binaries

Download the latest releases from the GitHub release page.

Docker Image

Pull the jq image to start quickly with Docker.

Building from source****Dependencies

libtool
make
automake
autoconf

Instructions

git submodule update --init # if building from git to get oniguruma autoreconf -i # if building from git ./configure --with-oniguruma=builtin make -j8 make check sudo make install

Build a statically linked version:

If you’re not using the latest git version but instead building a released tarball (available on the release page), skip the autoreconf step, and flex or bison won’t be needed.

Cross-Compilation

For details on cross-compilation, check out the GitHub Actions file and the cross-compilation wiki page.

Community & Support