-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 04 Aug 2026 20:56:56 +0800
Source: jq
Architecture: source
Version: 1.7.1-6+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: ChangZhuo Chen (陳昌倬) <czchen@debian.org>
Changed-By: Aron Xu <aron@debian.org>
Changes:
jq (1.7.1-6+deb13u3) trixie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* Cherry-pick upstream commit for the following:
CVE-2026-41256, CVE-2026-41257, CVE-2026-43896, CVE-2026-43895, CVE-2026-44777,
CVE-2026-43894, CVE-2026-47770, CVE-2026-49839, CVE-2026-54679, CVE-2026-40612,
GHSA-ggc9-rpv2-xgpm, GHSA-gvwx-xj9r-3frq, GHSA-gf4g-95wj-4q4r
* Add missing patch for CVE-2026-32316, a prerequisite for CVE-2026-54679 fix.
* Fix CVE-2024-53427 for real. The patch carried since 1.7.1-5 placed the
NaN payload check inside the DEC_Conversion_syntax branch, which already
returns JV_INVALID unconditionally, so it never had any effect and
"NaN123" still parsed. Move the check to the decNumberIsNaN branch as
upstream does, and update the two tests that encoded the old behaviour.
* Do not abort when repeating a string past the length bound. The
CVE-2026-32316 fix made jvp_string_append() able to return an invalid jv;
binop_multiply() appended in a loop without checking, so an input like
{"s":"abc","n":1000000000} with a filter of .s * .n aborted on an
assertion. Reject the operation up front and stop the loop on failure.
* Propagate invalid jv instead of aborting on it. The same change of
contract affects jvp_string_append(), jv_string_concat() and jv_sort();
callers written against the old always-valid contract abort on an
assertion. Guard centrally in jv.c so the @base64, @csv, @tsv, @sh, @uri
and escape_string loops are all covered, and guard jv_delpaths(),
jv_dump_string_trunc() and the jv_dump_string() results printed by
main.c. delpaths and the error-message paths are regressions against
previous version; the string-format ones replace the CVE-2026-32316
integer overflow with a proper error.
Checksums-Sha1:
b1cdbf3b498f97cdd15d12bff4a0fc501d3c2e8c 1687 jq_1.7.1-6+deb13u3.dsc
b84066c8abfda37b1eff2d4f9bc2187951e281e2 1323338 jq_1.7.1.orig.tar.gz
509d2ed79ebd09339ce66f285ca972e5823812fc 34064 jq_1.7.1-6+deb13u3.debian.tar.xz
91c214ca226dd5feb05c8525a9c6177f5c723ff8 6505 jq_1.7.1-6+deb13u3_source.buildinfo
Checksums-Sha256:
b8f3bb5475bf6efc82eb0f22469b86bfd3ce4316244bef360c38b038844bcbdb 1687 jq_1.7.1-6+deb13u3.dsc
fc75b1824aba7a954ef0886371d951c3bf4b6e0a921d1aefc553f309702d6ed1 1323338 jq_1.7.1.orig.tar.gz
815de96992ec0f465b03a0e08dbc5dffa59c3ef89585b5ae71bb877a8545759c 34064 jq_1.7.1-6+deb13u3.debian.tar.xz
4940f9ebe0e623ced90b1591db9f7533ad79afb6f6502e7aa116fb72816280cc 6505 jq_1.7.1-6+deb13u3_source.buildinfo
Files:
333b47f70c184e8db6b02f2ae4509fbc 1687 utils optional jq_1.7.1-6+deb13u3.dsc
6298967cd176a8e9f3e83b98f42295b6 1323338 utils optional jq_1.7.1.orig.tar.gz
b0cf7ee06d6ec508a56c643f37df9a5d 34064 utils optional jq_1.7.1-6+deb13u3.debian.tar.xz
8de70461651489196b7dfaf69478c351 6505 utils optional jq_1.7.1-6+deb13u3_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmp0LAgACgkQ+GQ1dHE8
m66ZPwgA4BU+QxsMcXx3ABCYbrp1fRsjfpVE8hSXXVCcLQduoykxAFToTTJlYBgj
D0bU94E+BXe8CFrTE//IMS+OnwJKnH1JT3eq3LiXLlZFHDOnl6elCcIOO3s+Mmdp
7jVW3wMPFyb5cSIVqVRaLfGxnmf2c1k5uc93wyUa04ZEpz0D6QzOxY4vpp9e8jy6
6lC/DEixu9URN/IDIl5C8aFeFGqtwveQbZeux9B97b6lOrOhcECz963rijiNdVXW
DM4hPKhjMgn25Kbq4CIFT3O4nduiJqI88C5cViEffF4wB2rRI3/zTrZXhHkxI8TS
4XxIZR29tknALOTXOsKRWuWDchHKtQ==
=oesj
-----END PGP SIGNATURE-----
