CVE-2017-6004: High severity pcre pcre vulnerability
The compilebracketmatchingpath function in pcrejitcompile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pcreto a version that resolves this vulnerability.Fixed in 8.41 - Upgrade
Upgrade
pcreto a version that resolves this vulnerability.Patch revision 1680 - Compensating control
Mitigate the PCRE JIT out-of-bounds read/DoS by disabling PCRE JIT if it is enabled until PCRE is upgraded past revision 1680 (PCRE through 8.x before revision 1680 is affected).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6004?
CVE-2017-6004 is classified as a high severity vulnerability due to its potential for causing denial of service.
How do I fix CVE-2017-6004?
To fix CVE-2017-6004, you should upgrade to PCRE versions 8.41 or above.
What types of attacks does CVE-2017-6004 enable?
CVE-2017-6004 enables remote attackers to cause a denial of service through crafted regular expressions.
Which versions of PCRE are affected by CVE-2017-6004?
CVE-2017-6004 affects PCRE versions before 8.41 and versions 8.x before revision 1680.
What are the consequences of exploiting CVE-2017-6004?
Exploiting CVE-2017-6004 can lead to out-of-bounds reads and application crashes.