Denial of Service Vulnerability in PCRE
Summary
CVE-2017-7186: libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup. Affects pcre across 2 version ranges.
< 8.40-r2
< 08f2a603e8ab886d1074f6ebab787f0ab05f1c2e
Fixed in 8.40-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PCRE (Perl Compatible Regular Expressions) is a library that provides support for regular expressions in various programming languages. It is widely used in applications for pattern matching and text processing. The vulnerability, identified as CVE-2017-7186, affects PCRE versions 8.40 and PCRE2 versions 10.23. It allows remote attackers to cause a denial of service by triggering an invalid Unicode property lookup, leading to a segmentation violation and application crash.
Vulnerability Detail
The vulnerability in PCRE arises from a flaw in the libpcre1 and libpcre2 libraries. When an attacker triggers an invalid Unicode property lookup, it causes a segmentation violation, resulting in the application crashing. This vulnerability can be exploited remotely, potentially leading to a complete denial of service. The vulnerability was first published on March 20, 2017, and has a CVSSv3 score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
8.40-r2
This is the first release that contains the fix.
sudo apk add --upgrade pcreTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the PCRE library to the fixed version to mitigate the risk of a denial of service attack.
Conclusion
The Denial of Service vulnerability in PCRE can be mitigated by updating the PCRE library to version 8.40-r2 or later. It is crucial to apply security updates promptly to protect systems from potential attacks. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pcre →
FAQ
PCRE (Perl Compatible Regular Expressions) is a library that provides support for regular expressions in various programming languages. It is commonly used for pattern matching and text processing.
The vulnerability allows remote attackers to cause a denial of service by triggering an invalid Unicode property lookup, leading to a segmentation violation and application crash.
To fix this vulnerability, update the PCRE library to version 8.40-r2 or later. Apply any available security updates to ensure the system is protected.
There is no known workaround for this vulnerability. Updating the PCRE library to the fixed version is the recommended solution.
The CVSSv3 score of this vulnerability is 7.5, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for pcre.
