CVE-2024-53427
MediumSummary
The decNumberCopy function in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write. This can be demonstrated by using --slurp with subtraction, such as a filter of .-. when the input has a certain form.
Risk Assessment
The vulnerability may allow an attacker to execute arbitrary code or cause a crash of the jq process, which in environments processing untrusted data could lead to system compromise or denial of service.
Recommendation
It is recommended to immediately update jq to a version newer than 1.7.1 if a patch is available, and to avoid processing untrusted input with --slurp and arithmetic operations until the update is applied.
Original NVD description (English source)
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of