CVE-2022-1587
Critical
Description
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Pcre2
PublishedMay 16, 2022
First seenMay 16, 2022
Weakness typeCWE-125Out-of-bounds read
How to fix
Update
- pcre pcre210.40 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pcre pcre2 | v < 10.40 | 10.40 |
| redhat enterprise_linux | 9.0 | — |
| fedoraproject fedora | 35, 36 | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp hci_management_node | No range specified | — |
| netapp ontap_select_deploy_administration_utility | No range specified | — |
| netapp solidfire | No range specified | — |
| netapp h300s_firmware | No range specified | — |
| netapp h500s_firmware | No range specified | — |
| netapp h700s_firmware | No range specified | — |
| netapp h410s_firmware | No range specified | — |
| netapp h410c_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.