Out-of-Bounds Read Vulnerability in PCRE2 Library
Summary
CVE-2022-1587: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. Affects pcre2 across 2 version ranges.
< 10.36-r1
< 03654e751e7f0700693526b67dfcadda6b42c9d0
Fixed in 10.36-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PCRE2 library is a regular expression library that provides support for pattern matching using regular expressions. It is widely used in various applications and programming languages. This vulnerability, identified as CVE-2022-1587, affects the PCRE2 library and specifically the get_recurse_data_length() function in the pcre2_jit_compile.c file. The vulnerability arises due to recursions in JIT-compiled regular expressions caused by duplicate data transfers.
Vulnerability Detail
The out-of-bounds read vulnerability in the PCRE2 library can be exploited by an attacker to read data outside the bounds of an allocated buffer. This can lead to information disclosure or potential crashes in applications that utilize the PCRE2 library. The vulnerability has a CVSS score of 9.1, indicating a high severity level. It was published on May 16, 2022, and last modified on November 29, 2023.
How To Fix
Minimum fixed version
10.36-r1
This is the first release that contains the fix.
sudo apk add --upgrade pcre2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The out-of-bounds read vulnerability in the PCRE2 library poses a significant risk to applications utilizing this library. It is crucial to update the library to a fixed version to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pcre2 →
FAQ
The vulnerability can potentially allow an attacker to read sensitive data or cause application crashes.
The vulnerability affects versions 0 to 10.36-r1 of the PCRE2 library in the Alpine Linux distributions v3.13 to v3.18.
There is no information available regarding any known exploits for this vulnerability at the moment.
The recommended mitigation is to update the PCRE2 library to a fixed version.
You can find more information about this vulnerability in the CVE-2022-1587 JSON file available at the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for pcre2.
