Skip to content

[AutoPR- Security] Patch jq for CVE-2025-9403 [MEDIUM]#14952

Merged
LeoMar4 merged 1 commit intomicrosoft:mainfrom
azurelinux-security:azure-autosec/jq/2.0/966839
Oct 30, 2025
Merged

[AutoPR- Security] Patch jq for CVE-2025-9403 [MEDIUM]#14952
LeoMar4 merged 1 commit intomicrosoft:mainfrom
azurelinux-security:azure-autosec/jq/2.0/966839

Conversation

@azurelinux-security
Copy link
Copy Markdown
Contributor

@azurelinux-security azurelinux-security commented Oct 29, 2025 •
edited by Kanishk-Bansal
Loading

Auto Patch jq for CVE-2025-9403.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=966839&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge
Summary

What does the PR accomplish, why was it needed?

Change Log
Does this affect the toolchain?

YES/NO

Associated issues
  • N/A
Links to CVEs
Test Methodology

@Kanishk-Bansal Kanishk-Bansal marked this pull request as ready for review October 29, 2025 05:43
@Kanishk-Bansal Kanishk-Bansal requested a review from a team as a code owner October 29, 2025 05:43
mfrw
mfrw approved these changes Oct 29, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@mfrw mfrw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread SPECS/jq/CVE-2025-9403.patch
- assert(jv_equal(jv_copy(expected), jv_copy(reparsed)));
- jv_free(as_string);
- jv_free(reparsed);
+ if (!(jv_get_kind(expected) == JV_KIND_NUMBER && isnan(jv_number_value(expected)))) {
Copy link
Copy Markdown
Member

@mfrw mfrw Oct 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch looks good to me :)

@Kanishk-Bansal Kanishk-Bansal added the ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review label Oct 29, 2025
@LeoMar4 LeoMar4 merged commit bdd91d4 into microsoft:main Oct 30, 2025
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mfrw mfrw mfrw approved these changes

@LeoMar4 LeoMar4 LeoMar4 approved these changes

Assignees

No one assigned

Labels

AI Backport AutoPR-Security main PR Destined for main Packaging ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@azurelinux-security @mfrw @LeoMar4 @Kanishk-Bansal