Ubuntu alert USN-7657-1 (jq)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7657-1] jq vulnerabilities
Date:
             
 
Mon, 21 Jul 2025 15:12:37 +0000
Message-ID:
             
 
<E1udsBx-0005IN-HS@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7657-1
July 21, 2025

jq vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.04
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in jq.

Software Description:
- jq: lightweight and flexible command-line JSON processor

Details:

It was discovered that jq incorrectly handled certain values when parsing
JSON data. A remote attacker could possibly use this issue to cause jq to
crash, resulting in a denial of service. (CVE-2024-23337)

It was discovered that jq incorrectly handled NaN values when parsing JSON
data. A remote attacker could possibly use this issue to cause jq to crash,
resulting in a denial of service. This issue only affected Ubuntu 24.04
LTS, and Ubuntu 25.04. (CVE-2024-53427)

It was discovered that jq incorrectly handled certain values when parsing
JSON data. A remote attacker could use this issue to cause jq to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2025-48060)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.04
  jq                              1.7.1-3ubuntu1.1
  libjq1                          1.7.1-3ubuntu1.1

Ubuntu 24.04 LTS
  jq                              1.7.1-3ubuntu0.24.04.1
  libjq1                          1.7.1-3ubuntu0.24.04.1

Ubuntu 22.04 LTS
  jq                              1.6-2.1ubuntu3.1
  libjq1                          1.6-2.1ubuntu3.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7657-1
  CVE-2024-23337, CVE-2024-53427, CVE-2025-48060

Package Information:
  https://launchpad.net/ubuntu/+source/jq/1.7.1-3ubuntu1.1
  https://launchpad.net/ubuntu/+source/jq/1.7.1-3ubuntu0.24...
  https://launchpad.net/ubuntu/+source/jq/1.6-2.1ubuntu3.1


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmh+WM8ACgkQcpJm3tlz
hgH50w/+OoOkVbk6UlQSlbyaO19Rm33twevoFhzVBbpvf1eIk0sK1awPN00qxacq
FyEI8f7GCrXFjKJg9xdGzLRGXkYMl4att6OMRtB21Fo3D59mjm7A8MyQxWzgFRvA
sFfTG/LYBoic4bg+KfxdJd/cSSo9r8gLKsgjMzv9KHjSQQ4NmlZa+NXHGo+49DYe
ObpQluUOCOZMVxzKO21f3eoruZPJuNTCeAXE8A0Tm9OrEIU6eQ87uWP243NLUJVr
kjLeoELfUVwbL1F1SttJx7WSQlNCryT3QLKbHDGuni7dqN4i7CtakPIRuTNnvq56
eUjkKxI8xAhIxS+c/jSfUIiczZ2xX8byo80PJtIgmCWeTg+G3osdk8ciWMn5oLKa
EUSoCwzxs2yhUQz2G8fB5pXa7mdo7zlFNQPAeFYnalmOXfqHG0Pzlz6hli3PlVwO
VOTUE/c2xpCSHM3uaV/E93XHXvuBzYZ7J5Rp0qVTxgfXch7nKNXnZzOj688brANo
cpQ7E9bTfSIf60nfVWjSnqmq4z2JFHRQc4TnWIvhrPHrZpAv0GZAGatrjZ5M2T5f
OcOGG8UIQ33Hww42lChy1f0ogMuQ3Qseq+SE+D2/e9KLEZGVA8xQ+nCFU8Z7CJDn
C0vO3MYi2dRYgTufov4oTEaKCeD9CBFYp/DRrw8WJDHIwdfffAc=
=CuYr
-----END PGP SIGNATURE-----