Log in Start free

Vulnerability · Published May 16, 2022 · Assigned by redhat

CVE-2022-1586

Critical 9.1

In plain English

A critical-severity out-of-bounds read in pcre2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)3.4%top 11.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8pcre210.32-3.el8_6ALSA-2022:5809
AlmaLinux:8pcre2-devel10.32-3.el8_6ALSA-2022:5809
AlmaLinux:8pcre2-tools10.32-3.el8_6ALSA-2022:5809
AlmaLinux:8pcre2-utf1610.32-3.el8_6ALSA-2022:5809
AlmaLinux:8pcre2-utf3210.32-3.el8_6ALSA-2022:5809
Alpine:v3.20pcre210.40-r0ALPINE-CVE-2022-1586
Alpine:v3.21pcre210.40-r0ALPINE-CVE-2022-1586
Alpine:v3.22pcre210.40-r0ALPINE-CVE-2022-1586
Alpine:v3.23pcre210.40-r0ALPINE-CVE-2022-1586
Alpine:v3.24pcre210.40-r0ALPINE-CVE-2022-1586
Debian:12pcre210.40-1DEBIAN-CVE-2022-1586
Debian:13pcre210.40-1DEBIAN-CVE-2022-1586
Debian:14pcre210.40-1DEBIAN-CVE-2022-1586
Rocky Linux:8pcre20:10.32-3.el8_6RLSA-2022:5809
Rocky Linux:9pcre20:10.37-5.el9_0RLSA-2022:5251
Ubuntu:22.04:LTSpcre210.39-3ubuntu0.1USN-5627-1
Ubuntu:22.04:LTSpcre210.39-3ubuntu0.1UBUNTU-CVE-2022-1586

Affected products (as reported)

VendorProductVersions
n/a pcre2 Fixed in pcre2-10.40.

Weakness: CWE-125

References