CVE-2023-50246 — MEDIUM (6.2)

Vulnerability Description

jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.

CVSS Score

6.2

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Jqlang	Jq	1.7

Related Weaknesses (CWE)

CWE-120 CWE-122 CWE-787

References

http://www.openwall.com/lists/oss-security/2023/12/15/10Mailing ListPatchThird Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574Mailing List
https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297Patch
https://github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vcExploitVendor Advisory
http://www.openwall.com/lists/oss-security/2023/12/15/10Mailing ListPatchThird Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574Mailing List
https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297Patch
https://github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vcExploitVendor Advisory

FAQ

What is CVE-2023-50246?

CVE-2023-50246 is a vulnerability with a CVSS score of 6.2 (MEDIUM). jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.

How severe is CVE-2023-50246?

CVE-2023-50246 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-50246?

Check the references section above for vendor advisories and patch information. Affected products include: Jqlang Jq.