First published: Tue Nov 03 2020(Updated: )
Oniguruma is a regular expressions library that supports a variety of character encodings. <br>Security Fix(es):<br><li> oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Additional Changes:<br>For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/oniguruma | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma-debuginfo | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma-debuginfo | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma-debugsource | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma-debugsource | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma-debuginfo | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma-debugsource | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma | <6.8.2-2.el8.aa | 6.8.2-2.el8.aa |
redhat/oniguruma-debuginfo | <6.8.2-2.el8.aa | 6.8.2-2.el8.aa |
redhat/oniguruma-debugsource | <6.8.2-2.el8.aa | 6.8.2-2.el8.aa |
redhat/oniguruma-devel | <6.8.2-2.el8.aa | 6.8.2-2.el8.aa |
redhat/oniguruma-devel | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma-devel | <6.8.2-2.el8 | 6.8.2-2.el8 |
redhat/oniguruma-devel | <6.8.2-2.el8 | 6.8.2-2.el8 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of RHSA-2020:4827 is classified as moderate.
To fix RHSA-2020:4827, update the oniguruma package to version 6.8.2-2.el8 or later.
RHSA-2020:4827 addresses a NULL pointer dereference vulnerability in match_at() in regexec.c, associated with CVE-2019-13225.
The affected software includes the oniguruma package in versions prior to 6.8.2-2.el8.
There is no official workaround; updating to the fixed version is the recommended approach.