CVE-2022-1586: Critical severity pcre2 vulnerability
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath() function of the pcre2jitcompile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
Other sources
An out-of-bounds read was discovered in PCRE version 10.39, related to a missing Unicode property matching issue in JIT compiled regular expressions. The bug is present in the function "compilexclassmatchingpath", declared in "pcre2jitcompile.c".
References:
https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-1586.
What is the severity of CVE-2022-1586?
The severity of CVE-2022-1586 is critical with a CVSS score of 9.1.
Which software is affected by CVE-2022-1586?
The PCRE2 library versions up to 10.40, Fedora 35 and 36, Redhat Enterprise Linux 8.0 and 9.0, and various Netapp products are affected by CVE-2022-1586.
What is the description of CVE-2022-1586?
CVE-2022-1586 is an out-of-bounds read vulnerability in the PCRE2 library due to a unicode property matching issue in JIT-compiled regular expressions.
How can I fix CVE-2022-1586?
Update to the latest version of the PCRE2 library (version 10.41 or later) or apply the relevant security patches provided by the affected software vendors.