Use-after-free vulnerability in Oniguruma library (CVE-2019-13224)
Summary
CVE-2019-13224: A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. Affects libonig across 3 version ranges.
< 0f7f61ed1b7b697e283e37bd2d731d0bd57adb55
< 6.9.2-1
>= 0221e9f827632942225586687a33cfd554860d5e, < 481520d3819b0b68b65539ff59b4bd2f018d6e5f
Fixed in 6.9.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Oniguruma library is a regular expression library that provides support for pattern matching using regular expressions. It is commonly used by programming languages like Ruby, PHP, and Rust. The library is responsible for handling regular expressions and can be vulnerable to certain types of attacks.
Vulnerability Detail
The CVE-2019-13224 vulnerability is a use-after-free vulnerability in the Oniguruma library. This vulnerability allows attackers to potentially cause information disclosure, denial of service, or even execute arbitrary code by providing a crafted regular expression. The vulnerability arises when the library handles a pair of a regex pattern and a string with a multi-byte encoding. Attackers can exploit this vulnerability by providing a malicious input that triggers the use-after-free condition in the onig_new_deluxe() function in regext.c. This vulnerability affects Oniguruma versions up to 6.9.2 and can impact applications that use the library, including Ruby, PHP, and Rust applications.
How To Fix
Minimum fixed version
6.9.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libonigTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the library is not immediately feasible, developers can consider implementing input validation and sanitization techniques to mitigate the risk of exploitation. By carefully validating and sanitizing user input before passing it to the Oniguruma library, developers can reduce the likelihood of triggering the use-after-free vulnerability.
Conclusion
The CVE-2019-13224 vulnerability is a use-after-free vulnerability in the Oniguruma library, which can impact applications that use this library, such as Ruby, PHP, and Rust applications. It is crucial to update the library to the fixed version to mitigate the risk of information disclosure, denial of service, or arbitrary code execution. If immediate update is not possible, implementing input validation and sanitization techniques can help reduce the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libonig →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to various security issues, including information disclosure, denial of service, or arbitrary code execution.
This vulnerability affects applications that use the Oniguruma library, including Ruby, PHP, and Rust applications. The impact may vary depending on how the library is utilized within each application.
The potential impact of this vulnerability includes information disclosure, denial of service, or even arbitrary code execution. The severity of the impact may depend on the specific context in which the vulnerable library is used.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including CVE-2019-13224.
You can find more information about this vulnerability, including technical details and the CVE entry, in the vulnerability database provided by Vulert (https://vulert.com).
Related vulnerabilities
Recent vulnerabilities recorded for libonig.
