CVE-2022-1586: Critical severity PCRE pcre2 vulnerability
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath() function of the pcre2jitcompile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
Other sources
An out-of-bounds read was discovered in PCRE version 10.39, related to a missing Unicode property matching issue in JIT compiled regular expressions. The bug is present in the function "compilexclassmatchingpath", declared in "pcre2jitcompile.c".
References:
https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pcre2to a version that resolves this vulnerability.Fixed in 10.40 - Upgrade
Upgrade
debian/pcre2to a version that resolves this vulnerability.Fixed in 10.42-1Fixed in 10.42-1+deb12u2Fixed in 10.46-1~deb13u2Fixed in 10.46-1~deb13u3Fixed in 10.48-3.1Fixed in 10.49-1 - Upgrade
Upgrade
alpine/pcre2to a version that resolves this vulnerability.Fixed in 10.36-r1 - Upgrade
Upgrade
alpine/pcre2to a version that resolves this vulnerability.Fixed in 10.40-r0 - Upgrade
Upgrade
ubuntu/pcre2to a version that resolves this vulnerability.Fixed in 10.31-2ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/pcre2to a version that resolves this vulnerability.Fixed in 10.34-7ubuntu0.1 - Upgrade
Upgrade
ubuntu/pcre2to a version that resolves this vulnerability.Fixed in 10.39-3ubuntu0.1 - Upgrade
Upgrade
debian/pcre2to a version that resolves this vulnerability.Fixed in 10.40-1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-1586.
What is the severity of CVE-2022-1586?
The severity of CVE-2022-1586 is critical with a CVSS score of 9.1.
Which software is affected by CVE-2022-1586?
The PCRE2 library versions up to 10.40, Fedora 35 and 36, Redhat Enterprise Linux 8.0 and 9.0, and various Netapp products are affected by CVE-2022-1586.
What is the description of CVE-2022-1586?
CVE-2022-1586 is an out-of-bounds read vulnerability in the PCRE2 library due to a unicode property matching issue in JIT-compiled regular expressions.
How can I fix CVE-2022-1586?
Update to the latest version of the PCRE2 library (version 10.41 or later) or apply the relevant security patches provided by the affected software vendors.