CVE-2017-9229: Oniguruma-mod in Ruby and mbstring in PHP Denial-of-Service Vulnerability
Summary
CVE-2017-9229: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. Affects php5 across 3 version ranges.
< 5.6.31-r0
< b690371bbf97794b4a1d3f295d4fb9a8b05d402d
>= fc1df8e7a6886e29a6ed5bef3f674ac61164e847, < de96a08a90e480f1afb655bcfeac8ac28a14228e
Fixed in 5.6.31-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Oniguruma is a regular expression library that is used in various programming languages, including Ruby and PHP. It provides powerful pattern matching capabilities for text processing. Oniguruma-mod is a modified version of Oniguruma used in Ruby, while mbstring is a PHP extension that handles multibyte character encodings. This vulnerability affects Oniguruma-mod in Ruby versions up to 2.4.1 and mbstring in PHP versions up to 7.1.5.
Vulnerability Detail
The vulnerability, identified as CVE-2017-9229, occurs during regular expression compilation in Oniguruma-mod and mbstring. It is caused by invalid handling of a specific parameter, which can lead to a SIGSEGV (Segmentation Fault) and result in a denial-of-service condition. An attacker can exploit this vulnerability by crafting a malicious regular expression pattern, causing the affected application to crash.
How To Fix
Minimum fixed version
5.6.31-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fixes provided by the respective software vendors.
Conclusion
CVE-2017-9229 is a denial-of-service vulnerability affecting Oniguruma-mod in Ruby and mbstring in PHP. It can be exploited by an attacker to crash the affected application. To mitigate this vulnerability, it is essential to update the affected packages to the fixed versions provided by the software vendors. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
Oniguruma is a regular expression library used in various programming languages for pattern matching.
Oniguruma-mod is a modified version of Oniguruma used in Ruby.
mbstring is a PHP extension that handles multibyte character encodings.
A denial-of-service vulnerability allows an attacker to disrupt the normal functioning of a system or application, rendering it unavailable to legitimate users.
To protect your application, it is crucial to keep your software dependencies up to date and apply the recommended security patches.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
