Amazon Linux 2023 Security Advisory: ALAS-2025-919
Advisory Release Date: 2025-03-26 20:44 Pacific
Advisory Updated Date: 2025-04-01 11:34 Pacific
Severity:
Important
Issue Overview:
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits). (CVE-2024-53427)
Affected Packages:
jq
Issue Correction:
Run dnf update jq --releasever 2023.7.20250331 to update your system.
New Packages:
aarch64:
jq-debugsource-1.7.1-49.amzn2023.0.2.aarch64
jq-debuginfo-1.7.1-49.amzn2023.0.2.aarch64
jq-devel-1.7.1-49.amzn2023.0.2.aarch64
jq-1.7.1-49.amzn2023.0.2.aarch64
src:
jq-1.7.1-49.amzn2023.0.2.src
x86_64:
jq-debugsource-1.7.1-49.amzn2023.0.2.x86_64
jq-devel-1.7.1-49.amzn2023.0.2.x86_64
jq-debuginfo-1.7.1-49.amzn2023.0.2.x86_64
jq-1.7.1-49.amzn2023.0.2.x86_64