Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

jq Vulnerability on Red Hat Systems - Arbitrary Code Execution

published 1 year ago

Summary

The jq software package on Red Hat systems contains a vulnerability that could allow an attacker to execute arbitrary code on a system. This could happen if a user runs a maliciously crafted JSON input file with the jq command. To fix this issue, update the jq package to the latest version.

What to do

Update redhat jq to version 0:1.6-6.el8_8.3.
Update redhat jq-debuginfo to version 0:1.6-6.el8_8.3.
Update redhat jq-debugsource to version 0:1.6-6.el8_8.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:8.8::appstream	redhat	jq	< 0:1.6-6.el8_8.3 Fix: upgrade to 0:1.6-6.el8_8.3
Red Hat:rhel_e4s:8.8::appstream	redhat	jq-debuginfo	< 0:1.6-6.el8_8.3 Fix: upgrade to 0:1.6-6.el8_8.3
Red Hat:rhel_e4s:8.8::appstream	redhat	jq-debugsource	< 0:1.6-6.el8_8.3 Fix: upgrade to 0:1.6-6.el8_8.3
Red Hat:rhel_tus:8.8::appstream	redhat	jq	< 0:1.6-6.el8_8.3 Fix: upgrade to 0:1.6-6.el8_8.3
Red Hat:rhel_tus:8.8::appstream	redhat	jq-debuginfo	< 0:1.6-6.el8_8.3 Fix: upgrade to 0:1.6-6.el8_8.3
Red Hat:rhel_tus:8.8::appstream	redhat	jq-debugsource	< 0:1.6-6.el8_8.3 Fix: upgrade to 0:1.6-6.el8_8.3

Original advisory text

Red Hat Security Advisory: jq security update

References

https://access.redhat.com/errata/RHSA-2025:10619 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2367807 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2367842 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10619.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-23337 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-23337 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-23337 Vendor Advisory
https://github.com/jqlang/jq/commit/de21386681c0df0104a99d9d09db23a9b2a78b1e Third Party Advisory
https://github.com/jqlang/jq/issues/3262 Third Party Advisory
https://github.com/jqlang/jq/security/advisories/GHSA-2q6r-344g-cx46 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-48060 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-48060 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-48060 Vendor Advisory
https://github.com/jqlang/jq/security/advisories/GHSA-p7rr-28xf-3m5w Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Timeline

Published9 Jul 2025

Updated10 Jun 2026

First seen10 Jun 2026

Sources

RHSA-2025:10619 · OSV

Track software like this

Free during beta