{"schema_version":"1.7.2","id":"OESA-2025-1809","modified":"2025-07-11T12:24:20Z","published":"2025-07-11T12:24:20Z","upstream":["CVE-2024-23337","CVE-2025-48060","CVE-2025-49014"],"summary":"jq security update","details":"jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.\r\n\r\nSecurity Fix(es):\n\njq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.(CVE-2024-23337)\n\njq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.(CVE-2025-48060)\n\njq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.(CVE-2025-49014)","affected":[{"package":{"ecosystem":"openEuler:22.03-LTS-SP3","name":"jq","purl":"pkg:rpm/openEuler/jq\u0026distro=openEuler-22.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2203sp3"}]}],"ecosystem_specific":{"aarch64":["jq-1.8.0-2.oe2203sp3.aarch64.rpm","jq-debuginfo-1.8.0-2.oe2203sp3.aarch64.rpm","jq-debugsource-1.8.0-2.oe2203sp3.aarch64.rpm","jq-devel-1.8.0-2.oe2203sp3.aarch64.rpm"],"noarch":["jq-help-1.8.0-2.oe2203sp3.noarch.rpm"],"src":["jq-1.8.0-2.oe2203sp3.src.rpm"],"x86_64":["jq-1.8.0-2.oe2203sp3.x86_64.rpm","jq-debuginfo-1.8.0-2.oe2203sp3.x86_64.rpm","jq-debugsource-1.8.0-2.oe2203sp3.x86_64.rpm","jq-devel-1.8.0-2.oe2203sp3.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"jq","purl":"pkg:rpm/openEuler/jq\u0026distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2203sp4"}]}],"ecosystem_specific":{"aarch64":["jq-1.8.0-2.oe2203sp4.aarch64.rpm","jq-debuginfo-1.8.0-2.oe2203sp4.aarch64.rpm","jq-debugsource-1.8.0-2.oe2203sp4.aarch64.rpm","jq-devel-1.8.0-2.oe2203sp4.aarch64.rpm"],"noarch":["jq-help-1.8.0-2.oe2203sp4.noarch.rpm"],"src":["jq-1.8.0-2.oe2203sp4.src.rpm"],"x86_64":["jq-1.8.0-2.oe2203sp4.x86_64.rpm","jq-debuginfo-1.8.0-2.oe2203sp4.x86_64.rpm","jq-debugsource-1.8.0-2.oe2203sp4.x86_64.rpm","jq-devel-1.8.0-2.oe2203sp4.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS","name":"jq","purl":"pkg:rpm/openEuler/jq\u0026distro=openEuler-24.03-LTS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2403sp2"}]}],"ecosystem_specific":{"aarch64":["jq-1.8.0-2.oe2403.aarch64.rpm","jq-debuginfo-1.8.0-2.oe2403.aarch64.rpm","jq-debugsource-1.8.0-2.oe2403.aarch64.rpm","jq-devel-1.8.0-2.oe2403.aarch64.rpm","jq-1.8.0-2.oe2403sp1.aarch64.rpm","jq-debuginfo-1.8.0-2.oe2403sp1.aarch64.rpm","jq-debugsource-1.8.0-2.oe2403sp1.aarch64.rpm","jq-devel-1.8.0-2.oe2403sp1.aarch64.rpm","jq-1.8.0-2.oe2403sp2.aarch64.rpm","jq-debuginfo-1.8.0-2.oe2403sp2.aarch64.rpm","jq-debugsource-1.8.0-2.oe2403sp2.aarch64.rpm","jq-devel-1.8.0-2.oe2403sp2.aarch64.rpm"],"noarch":["jq-help-1.8.0-2.oe2403.noarch.rpm","jq-help-1.8.0-2.oe2403sp1.noarch.rpm","jq-help-1.8.0-2.oe2403sp2.noarch.rpm"],"src":["jq-1.8.0-2.oe2403.src.rpm","jq-1.8.0-2.oe2403sp1.src.rpm","jq-1.8.0-2.oe2403sp2.src.rpm"],"x86_64":["jq-1.8.0-2.oe2403.x86_64.rpm","jq-debuginfo-1.8.0-2.oe2403.x86_64.rpm","jq-debugsource-1.8.0-2.oe2403.x86_64.rpm","jq-devel-1.8.0-2.oe2403.x86_64.rpm","jq-1.8.0-2.oe2403sp1.x86_64.rpm","jq-debuginfo-1.8.0-2.oe2403sp1.x86_64.rpm","jq-debugsource-1.8.0-2.oe2403sp1.x86_64.rpm","jq-devel-1.8.0-2.oe2403sp1.x86_64.rpm","jq-1.8.0-2.oe2403sp2.x86_64.rpm","jq-debuginfo-1.8.0-2.oe2403sp2.x86_64.rpm","jq-debugsource-1.8.0-2.oe2403sp2.x86_64.rpm","jq-devel-1.8.0-2.oe2403sp2.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"jq","purl":"pkg:rpm/openEuler/jq\u0026distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["jq-1.8.0-2.oe2403sp1.aarch64.rpm","jq-debuginfo-1.8.0-2.oe2403sp1.aarch64.rpm","jq-debugsource-1.8.0-2.oe2403sp1.aarch64.rpm","jq-devel-1.8.0-2.oe2403sp1.aarch64.rpm"],"noarch":["jq-help-1.8.0-2.oe2403sp1.noarch.rpm"],"src":["jq-1.8.0-2.oe2403sp1.src.rpm"],"x86_64":["jq-1.8.0-2.oe2403sp1.x86_64.rpm","jq-debuginfo-1.8.0-2.oe2403sp1.x86_64.rpm","jq-debugsource-1.8.0-2.oe2403sp1.x86_64.rpm","jq-devel-1.8.0-2.oe2403sp1.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP2","name":"jq","purl":"pkg:rpm/openEuler/jq\u0026distro=openEuler-24.03-LTS-SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2403sp2"}]}],"ecosystem_specific":{"aarch64":["jq-1.8.0-2.oe2403sp2.aarch64.rpm","jq-debuginfo-1.8.0-2.oe2403sp2.aarch64.rpm","jq-debugsource-1.8.0-2.oe2403sp2.aarch64.rpm","jq-devel-1.8.0-2.oe2403sp2.aarch64.rpm"],"noarch":["jq-help-1.8.0-2.oe2403sp2.noarch.rpm"],"src":["jq-1.8.0-2.oe2403sp2.src.rpm"],"x86_64":["jq-1.8.0-2.oe2403sp2.x86_64.rpm","jq-debuginfo-1.8.0-2.oe2403sp2.x86_64.rpm","jq-debugsource-1.8.0-2.oe2403sp2.x86_64.rpm","jq-devel-1.8.0-2.oe2403sp2.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"jq","purl":"pkg:rpm/openEuler/jq\u0026distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2003sp4"}]}],"ecosystem_specific":{"aarch64":["jq-1.8.0-2.oe2003sp4.aarch64.rpm","jq-debuginfo-1.8.0-2.oe2003sp4.aarch64.rpm","jq-debugsource-1.8.0-2.oe2003sp4.aarch64.rpm","jq-devel-1.8.0-2.oe2003sp4.aarch64.rpm"],"noarch":["jq-help-1.8.0-2.oe2003sp4.noarch.rpm"],"src":["jq-1.8.0-2.oe2003sp4.src.rpm"],"x86_64":["jq-1.8.0-2.oe2003sp4.x86_64.rpm","jq-debuginfo-1.8.0-2.oe2003sp4.x86_64.rpm","jq-debugsource-1.8.0-2.oe2003sp4.x86_64.rpm","jq-devel-1.8.0-2.oe2003sp4.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1809"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23337"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48060"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49014"}],"database_specific":{"severity":"High"}}