diff mbox series

[meta-oe,scarthgap] jq: fix CVE-2026-39956

Message ID 20260729073123.25188-1-tugrul.kukul@est.tech
State New
Headers show
Series [meta-oe,scarthgap] jq: fix CVE-2026-39956 | expand

Commit Message

tugrul.kukul@est.tech July 29, 2026, 7:31 a.m. UTC 
From: Tugrul Kukul <tugrul.kukul@est.tech>

Backport patch to fix CVE-2026-39956.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-39956
  https://www.cve.org/CVERecord?id=CVE-2026-39956
  https://security-tracker.debian.org/tracker/CVE-2026-39956
  https://osv.dev/list?q=CVE-2026-39956

Upstream fix:
  https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03 [nvd]

Tested with ptest:
Before: PASSED: 7, FAILED: 0, SKIPPED: 0
After: PASSED: 7, FAILED: 0, SKIPPED: 0

Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
---
 .../jq/jq/CVE-2026-39956.patch                | 55 +++++++++++++++++++
 meta-oe/recipes-devtools/jq/jq_1.7.1.bb       |  1 +
 2 files changed, 56 insertions(+)
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-39956.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-devtools/jq/jq/CVE-2026-39956.patch b/meta-oe/recipes-devtools/jq/jq/CVE-2026-39956.patch
new file mode 100644
index 0000000000..6a3f61dc37
--- /dev/null
+++ b/meta-oe/recipes-devtools/jq/jq/CVE-2026-39956.patch
@@ -0,0 +1,55 @@ 
+From 04834a11ffb9f988643fe64480cfb8553ff498af Mon Sep 17 00:00:00 2001
+From: tlsbollei <170938166+tlsbollei@users.noreply.github.com>
+Date: Wed, 8 Apr 2026 21:43:46 +0200
+Subject: [PATCH] Add runtime type checks to f_string_indexes
+
+This fixes CVE-2026-39956.
+
+CVE: CVE-2026-39956
+Upstream-Status: Backport [https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03]
+
+Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
+---
+ src/builtin.c | 8 ++++++++
+ tests/jq.test | 9 +++++++++
+ 2 files changed, 17 insertions(+)
+
+diff --git a/src/builtin.c b/src/builtin.c
+index 378be02..08b94ac 100644
+--- a/src/builtin.c
++++ b/src/builtin.c
+@@ -1215,6 +1215,14 @@ static jv f_string_explode(jq_state *jq, jv a) {
+ }
+ 
+ static jv f_string_indexes(jq_state *jq, jv a, jv b) {
++  if (jv_get_kind(a) != JV_KIND_STRING) {
++    jv_free(b);
++    return type_error(a, "cannot be searched, as it is not a string");
++  }
++  if (jv_get_kind(b) != JV_KIND_STRING) {
++    jv_free(a);
++    return type_error(b, "is not a string");
++  }
+   return jv_string_indexes(a, b);
+ }
+ 
+diff --git a/tests/jq.test b/tests/jq.test
+index 6d1518d..f867e25 100644
+--- a/tests/jq.test
++++ b/tests/jq.test
+@@ -1333,6 +1333,15 @@ split("")
+ "xababababax"
+ [1,7,[1,3,5,7]]
+ 
++# _strindices is used by indices/1 but is callable
++try _strindices("abc") catch .
++123
++"number (123) cannot be searched, as it is not a string"
++
++try _strindices(123) catch .
++"abc"
++"number (123) is not a string"
++
+ indices(1)
+ [0,1,1,2,3,4,1,5]
+ [1,2,6]
diff --git a/meta-oe/recipes-devtools/jq/jq_1.7.1.bb b/meta-oe/recipes-devtools/jq/jq_1.7.1.bb
index 2fc47ef92c..42c7a5795a 100644
--- a/meta-oe/recipes-devtools/jq/jq_1.7.1.bb
+++ b/meta-oe/recipes-devtools/jq/jq_1.7.1.bb
@@ -25,6 +25,7 @@  SRC_URI = "${GITHUB_BASE_URI}/download/${BPN}-${PV}/${BPN}-${PV}.tar.gz \
     file://CVE-2026-41257.patch \
     file://CVE-2026-43894.patch \
     file://CVE-2026-43896.patch \
+    file://CVE-2026-39956.patch \
     "
 SRC_URI[sha256sum] = "478c9ca129fd2e3443fe27314b455e211e0d8c60bc8ff7df703873deeee580c2"