Detections
Analytics
Alpine: multiple jq packages: security update to 1.8.0-r0
high Tenable Self-Hosted Container Security Plugin ID 427827
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises
when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of
service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue. (CVE-2024-23337)
- decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as
numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use
of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string
with NaN (e.g., "1 NaN123" immediately followed by many more digits). (CVE-2024-53427)
- jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is
present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on
file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are
available. (CVE-2025-48060)
See Also
https://security.alpinelinux.org/vuln/CVE-2024-23337
Plugin Details
Severity: High
ID: 427827
Version: Revision 1.34
Type: Local
Published: 6/2/2025
Updated: 7/10/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.7
Percentile: 99.14
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2025-48060
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 7.7
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 2/26/2025