[Bug 2063014] Re: CVE-2023-50246 and CVE-2023-50268

2024-04-22 Thread Mark Esler
** Changed in: jq (Ubuntu) Status: New => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2063014 Title: CVE-2023-50246 and CVE-2023-50268 To manage notifications about this bug

[Bug 2063014] Re: CVE-2023-50246 and CVE-2023-50268

2024-04-22 Thread Mark Esler
CVE-2023-50246 only affects jq >= 1.7 until 1.7.1. That issue was introduced with cf4b48c7ba30cb30e116b523cff036ea481459f6. Mantic (23.10) has jq version 1.6-3 and Noble (24.04) has 1.7.1-3build1. This is why unaffected versions are labeled as "Not vulnerable (code not present)" on