Astra Linux – Vulnerability in jq

jq is a command-line JSON processor. In versions 1.8.1 and below, functions jvsetpath, jvgetpath, and delpathssorted in jq’s src/jvaux.c use unbounded recursion whose depth is controlled by the length of a path array provided by the caller, with no depth limit enforced. An attacker can provide a...