REDHAT-BUG-384761: High severity PCRE PCRE vulnerability
From pcre changelog, version 6.7:
18. A valid (though odd) pattern that looked like a POSIX character class but used an invalid character after [ (for example [[,abc,]]) caused pcrecompile() to give the error "Failed: internal error: code overflow" or in some cases to crash with a glibc free() error. This could even happen if the pattern terminated after [[ but there just happened to be a sequence of letters, a binary zero, and a closing ] in the memory that followed.
Acknowledgements:
Red Hat would like to thank Ludwig Nussel for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-384761?
The severity of REDHAT-BUG-384761 is considered high due to the potential crash of applications using the PCRE library.
How do I fix REDHAT-BUG-384761?
To fix REDHAT-BUG-384761, update your PCRE library to the latest version that addresses the internal error and crash.
What systems are affected by REDHAT-BUG-384761?
REDHAT-BUG-384761 affects systems using versions of the PCRE library prior to its patch for this vulnerability.
What is the cause of the issue in REDHAT-BUG-384761?
The issue in REDHAT-BUG-384761 is caused by invalid patterns in character classes leading to code overflow errors or crashes.
Is there any workaround for REDHAT-BUG-384761?
A possible workaround for REDHAT-BUG-384761 is to avoid using invalid character class patterns in your regular expressions.