Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure
Vulnerability Description
jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Vulnerability Type
跨界内存读
Vulnerability Title
jq 安全漏洞
Vulnerability Description
jq是jqlang开源的一个轻量级且灵活的命令行 JSON 处理器。 jq存在安全漏洞，该漏洞源于_strindices内置函数未验证参数类型，可能导致崩溃或受控指针取消引用。
CVSS Information
N/A
Vulnerability Type
N/A