Denial of Service Vulnerability in PCRE Package - CVE-2017-7186
Summary
ALPINE-CVE-2017-7186: libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup. Affects pcre versions < 8.40-r2. Fixed in 8.40-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PCRE (Perl Compatible Regular Expressions) is a library that provides functions for using regular expressions in C and C++ programs. It is widely used for string matching and manipulation in various applications. The library is known for its performance and flexibility, allowing developers to implement complex pattern matching. However, certain versions of PCRE are vulnerable to a denial of service attack due to improper handling of Unicode property lookups.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7186, exists in libpcre1 of PCRE version 8.40 and libpcre2 of PCRE2 version 10.23. It allows remote attackers to trigger a segmentation violation, leading to application crashes. This occurs when an invalid Unicode property lookup is performed, resulting in a denial of service. The vulnerability can be exploited without authentication, making it particularly dangerous for applications relying on PCRE for regular expression processing.
How To Fix
Minimum fixed version
8.40-r2
This is the first release that contains the fix.
sudo apk add --upgrade pcreTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, consider implementing input validation to prevent malformed Unicode property lookups. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
CVE-2017-7186 is a significant denial of service vulnerability in the PCRE library, affecting multiple versions. It is crucial for developers and system administrators to update their PCRE packages to the patched version to mitigate the risk of exploitation. Regular monitoring using tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for pcre →
FAQ
CVE-2017-7186 is a vulnerability in the PCRE library that allows remote attackers to cause a denial of service by triggering an invalid Unicode property lookup.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability can lead to application crashes, resulting in denial of service for users and potential disruption of services.
Yes, the patched version of the PCRE package is 8.40-r2. Updating to this version will resolve the vulnerability.
The CVSS score for CVE-2017-7186 is 7.5, indicating a high severity level for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcre.
