kritisch
CVE-2022-1587
pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, CBL-Mariner. Niedriger laut Red Hat (mittel), Amazon (mittel), Oracle (mittel), Rocky Linux (mittel), Ubuntu (niedrig).
Beschreibung
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| CBL-Mariner 1.0 | pcre2 | 0:10.34-2.cm1 |
| alpine 3.13 | pcre2 | 10.36-r1 |
| alpine 3.14 | pcre2 | 10.36-r1 |
| alpine 3.15 | pcre2 | 10.40-r0 |
| alpine 3.16 | pcre2 | 10.40-r0 |
| alpine 3.17 | pcre2 | 10.40-r0 |
| alpine 3.18 | pcre2 | 10.40-r0 |
| alpine 3.19 | pcre2 | 10.40-r0 |
| alpine 3.20 | pcre2 | 10.40-r0 |
| alpine 3.21 | pcre2 | 10.40-r0 |
| alpine 3.22 | pcre2 | 10.40-r0 |
| alpine 3.23 | pcre2 | 10.40-r0 |
Alle 64 Einträge aus 34 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| CBL-Mariner 1.0 | pcre2 | 0:10.34-2.cm1 |
| alpine 3.13 | pcre2 | 10.36-r1 |
| alpine 3.14 | pcre2 | 10.36-r1 |
| alpine 3.15 | pcre2 | 10.40-r0 |
| alpine 3.16 | pcre2 | 10.40-r0 |
| alpine 3.17 | pcre2 | 10.40-r0 |
| alpine 3.18 | pcre2 | 10.40-r0 |
| alpine 3.19 | pcre2 | 10.40-r0 |
| alpine 3.20 | pcre2 | 10.40-r0 |
| alpine 3.21 | pcre2 | 10.40-r0 |
| alpine 3.22 | pcre2 | 10.40-r0 |
| alpine 3.23 | pcre2 | 10.40-r0 |
| alpine 3.24 | pcre2 | 10.40-r0 |
| alpine edge | pcre2 | 10.40-r0 |
| amazon linux 2022 | pcre2 | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-debuginfo | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-debugsource | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-devel | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-static | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-syntax | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-tools | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-tools-debuginfo | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-utf16 | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-utf16-debuginfo | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-utf32 | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-utf32-debuginfo | 10.40-1.amzn2022.0.1 |
| amazon linux 2023 | pcre2 | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-debuginfo | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-debugsource | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-devel | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-static | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-syntax | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-tools | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-tools-debuginfo | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-utf16 | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-utf16-debuginfo | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-utf32 | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-utf32-debuginfo | 10.40-1.amzn2023.0.2 |
| chainguard | pcre2 | 0 |
| conan::GitLab Advisory Database Community | pcre2 | 10.40 |
| debian 10 | pcre2 | 10.32-5+deb10u1 |
| debian 11 | pcre2 | 10.36-2+deb11u1 |
| debian 12 | pcre2 | 10.40-1 |
| debian 13 | pcre2 | 10.40-1 |
| debian 14 | pcre2 | 10.40-1 |
| debian 9 | pcre2 | kein Fix angegeben |
| echo | pcre2 | 10.40-1 |
| Oracle Linux 9 | pcre2 | 10.37-5.el9_0 |
| Oracle Linux 9 | pcre2-devel | 10.37-5.el9_0 |
| Oracle Linux 9 | pcre2-syntax | 10.37-5.el9_0 |
| Oracle Linux 9 | pcre2-utf16 | 10.37-5.el9_0 |
| Oracle Linux 9 | pcre2-utf32 | 10.37-5.el9_0 |
| rapidfort Oracle Linux 9 | pcre2 | 0:10.37-5.el9_0 |
| rocky 9 | pcre2 | 10.37-5.el9_0 |
| rocky 9 | pcre2-devel | 10.37-5.el9_0 |
| rocky 9 | pcre2-syntax | 10.37-5.el9_0 |
| rocky 9 | pcre2-utf16 | 10.37-5.el9_0 |
| rocky 9 | pcre2-utf32 | 10.37-5.el9_0 |
| root.io ubuntu 22.04 | rootio-pcre2 | 10.39-3ubuntu0.1 |
| ubuntu 18.04-ESM | pcre2 | 10.31-2ubuntu0.1~esm1 |
| ubuntu 20.04 | pcre2 | 10.34-7ubuntu0.1 |
| ubuntu 20.04-ESM | pcre2 | 10.34-7ubuntu0.1 |
| ubuntu 22.04 | pcre2 | 10.39-3ubuntu0.1 |
| wolfi | pcre2 | 0 |
Referenzen
- https://access.redhat.com/errata/RHSA-2022:5251
- https://access.redhat.com/security/cve/CVE-2022-1587
- https://bugzilla.redhat.com/show_bug.cgi?id=2077976
- https://bugzilla.redhat.com/show_bug.cgi?id=2077983
- https://bugzilla.redhat.com/show_bug.cgi?id=2077983%2C
- https://bugzilla.redhat.com/show_bug.cgi?id=2077983,
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1586
Alle 23 Referenzen
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1587
- https://errata.rockylinux.org/RLSA-2022:5251
- https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0
- https://linux.oracle.com/cve/CVE-2022-1587.html
- https://linux.oracle.com/errata/ELSA-2022-5251.html
- https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1587
- https://security.netapp.com/advisory/ntap-20221028-0009/
- https://ubuntu.com/security/notices/USN-5627-1
- https://ubuntu.com/security/notices/USN-5627-2
- https://www.cve.org/CVERecord?id=CVE-2022-1587