CVE-2024-53427

Katalog CVE

CVSS 8.1 · High EPSS 0,36%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada jqlang jq. Skor CVSS 3.1 8.1 (High) menurut mitre.org.

Deskripsi (NVD)

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).

Rincian

Terbit di NVD

26 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber mitre.org
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jqlang/jq/issues/3196 exploit · issue tracking · advisory vendor
• https://github.com/jqlang/jq/issues/3296 issue tracking · advisory vendor
• https://github.com/jqlang/jq/security/advisories/GHSA-x6c3-qv5r-7q22 advisory vendor
• https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92 advisory pihak ketiga
• https://github.com/jqlang/jq/blob/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297/src/decNumber/decNumber.c#L3375 product