Cette page suit l'état du correctif pour Alpine Linux. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-43895 →
ALPINE-CVE-2026-43895
jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Alpine:v3.22
jq
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-r0"}]}]
Alpine:v3.23
jq
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-r0"}]}]
Alpine:v3.24
jq
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-r0"}]}]
Références
- advisory security.alpinelinux.org