REDHAT-BUG-2367842
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2367842?
The severity of REDHAT-BUG-2367842 is classified as critical due to the heap-buffer-overflow vulnerability.
How do I fix REDHAT-BUG-2367842?
To fix REDHAT-BUG-2367842, update to a patched version of jq that is above 1.7.1 once it becomes available.
Which versions are affected by REDHAT-BUG-2367842?
REDHAT-BUG-2367842 affects jq versions up to and including 1.7.1.
What is the vulnerable function in REDHAT-BUG-2367842?
The vulnerable function in REDHAT-BUG-2367842 is `jv_string_vfmt` in the jv.c file.
What type of vulnerability is REDHAT-BUG-2367842?
REDHAT-BUG-2367842 is a heap-buffer-overflow vulnerability, which can lead to potential crashes or malicious exploitation.