ID

VAR-202006-0222

CVE

CVE-2020-14155

TITLE

PCRE Integer overflow vulnerability in

DESCRIPTION

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. PCRE is an open source regular expression library written in C language by Philip Hazel software developer. An input validation error vulnerability exists in libpcre in versions prior to PCRE 8.44. An attacker could exploit this vulnerability to execute arbitrary code or cause an application to crash on the system with a large number of requests. ========================================================================== Ubuntu Security Notice USN-5425-1 May 17, 2022 pcre3 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: Several security issues were fixed in PCRE. An attacker could possibly use this issue to cause applications using PCRE to expose sensitive information. This issue only affects Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 21.10 and Ubuntu 22.04 LTS. (CVE-2019-20838) It was discovered that PCRE incorrectly handled memory when handling certain regular expressions. An attacker could possibly use this issue to cause applications using PCRE to have unexpected behavior. This issue only affects Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14155) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: libpcre3 2:8.39-13ubuntu0.22.04.1 Ubuntu 21.10: libpcre3 2:8.39-13ubuntu0.21.10.1 Ubuntu 20.04 LTS: libpcre3 2:8.39-12ubuntu0.1 Ubuntu 18.04 LTS: libpcre3 2:8.39-9ubuntu0.1 Ubuntu 16.04 ESM: libpcre3 2:8.38-3.1ubuntu0.1~esm1 Ubuntu 14.04 ESM: libpcre3 1:8.31-2ubuntu2.3+esm1 After a standard system update you need to restart applications using PCRE, such as the Apache HTTP server and Nginx, to make all the necessary changes. Bugs fixed (https://bugzilla.redhat.com/): 2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Low: pcre security update Advisory ID: RHSA-2021:4373-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4373 Issue date: 2021-11-09 CVE Names: CVE-2019-20838 CVE-2020-14155 ==================================================================== 1. Summary: An update for pcre is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux CRB (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: PCRE is a Perl-compatible regular expression library. Security Fix(es): * pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 (CVE-2019-20838) * pcre: Integer overflow when parsing callout numeric arguments (CVE-2020-14155) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1848436 - CVE-2020-14155 pcre: Integer overflow when parsing callout numeric arguments 1848444 - CVE-2019-20838 pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 6. Package List: Red Hat Enterprise Linux BaseOS (v. 8): Source: pcre-8.42-6.el8.src.rpm aarch64: pcre-8.42-6.el8.aarch64.rpm pcre-cpp-8.42-6.el8.aarch64.rpm pcre-cpp-debuginfo-8.42-6.el8.aarch64.rpm pcre-debuginfo-8.42-6.el8.aarch64.rpm pcre-debugsource-8.42-6.el8.aarch64.rpm pcre-devel-8.42-6.el8.aarch64.rpm pcre-tools-debuginfo-8.42-6.el8.aarch64.rpm pcre-utf16-8.42-6.el8.aarch64.rpm pcre-utf16-debuginfo-8.42-6.el8.aarch64.rpm pcre-utf32-8.42-6.el8.aarch64.rpm pcre-utf32-debuginfo-8.42-6.el8.aarch64.rpm ppc64le: pcre-8.42-6.el8.ppc64le.rpm pcre-cpp-8.42-6.el8.ppc64le.rpm pcre-cpp-debuginfo-8.42-6.el8.ppc64le.rpm pcre-debuginfo-8.42-6.el8.ppc64le.rpm pcre-debugsource-8.42-6.el8.ppc64le.rpm pcre-devel-8.42-6.el8.ppc64le.rpm pcre-tools-debuginfo-8.42-6.el8.ppc64le.rpm pcre-utf16-8.42-6.el8.ppc64le.rpm pcre-utf16-debuginfo-8.42-6.el8.ppc64le.rpm pcre-utf32-8.42-6.el8.ppc64le.rpm pcre-utf32-debuginfo-8.42-6.el8.ppc64le.rpm s390x: pcre-8.42-6.el8.s390x.rpm pcre-cpp-8.42-6.el8.s390x.rpm pcre-cpp-debuginfo-8.42-6.el8.s390x.rpm pcre-debuginfo-8.42-6.el8.s390x.rpm pcre-debugsource-8.42-6.el8.s390x.rpm pcre-devel-8.42-6.el8.s390x.rpm pcre-tools-debuginfo-8.42-6.el8.s390x.rpm pcre-utf16-8.42-6.el8.s390x.rpm pcre-utf16-debuginfo-8.42-6.el8.s390x.rpm pcre-utf32-8.42-6.el8.s390x.rpm pcre-utf32-debuginfo-8.42-6.el8.s390x.rpm x86_64: pcre-8.42-6.el8.i686.rpm pcre-8.42-6.el8.x86_64.rpm pcre-cpp-8.42-6.el8.i686.rpm pcre-cpp-8.42-6.el8.x86_64.rpm pcre-cpp-debuginfo-8.42-6.el8.i686.rpm pcre-cpp-debuginfo-8.42-6.el8.x86_64.rpm pcre-debuginfo-8.42-6.el8.i686.rpm pcre-debuginfo-8.42-6.el8.x86_64.rpm pcre-debugsource-8.42-6.el8.i686.rpm pcre-debugsource-8.42-6.el8.x86_64.rpm pcre-devel-8.42-6.el8.i686.rpm pcre-devel-8.42-6.el8.x86_64.rpm pcre-tools-debuginfo-8.42-6.el8.i686.rpm pcre-tools-debuginfo-8.42-6.el8.x86_64.rpm pcre-utf16-8.42-6.el8.i686.rpm pcre-utf16-8.42-6.el8.x86_64.rpm pcre-utf16-debuginfo-8.42-6.el8.i686.rpm pcre-utf16-debuginfo-8.42-6.el8.x86_64.rpm pcre-utf32-8.42-6.el8.i686.rpm pcre-utf32-8.42-6.el8.x86_64.rpm pcre-utf32-debuginfo-8.42-6.el8.i686.rpm pcre-utf32-debuginfo-8.42-6.el8.x86_64.rpm Red Hat Enterprise Linux CRB (v. 8): aarch64: pcre-cpp-debuginfo-8.42-6.el8.aarch64.rpm pcre-debuginfo-8.42-6.el8.aarch64.rpm pcre-debugsource-8.42-6.el8.aarch64.rpm pcre-static-8.42-6.el8.aarch64.rpm pcre-tools-debuginfo-8.42-6.el8.aarch64.rpm pcre-utf16-debuginfo-8.42-6.el8.aarch64.rpm pcre-utf32-debuginfo-8.42-6.el8.aarch64.rpm ppc64le: pcre-cpp-debuginfo-8.42-6.el8.ppc64le.rpm pcre-debuginfo-8.42-6.el8.ppc64le.rpm pcre-debugsource-8.42-6.el8.ppc64le.rpm pcre-static-8.42-6.el8.ppc64le.rpm pcre-tools-debuginfo-8.42-6.el8.ppc64le.rpm pcre-utf16-debuginfo-8.42-6.el8.ppc64le.rpm pcre-utf32-debuginfo-8.42-6.el8.ppc64le.rpm s390x: pcre-cpp-debuginfo-8.42-6.el8.s390x.rpm pcre-debuginfo-8.42-6.el8.s390x.rpm pcre-debugsource-8.42-6.el8.s390x.rpm pcre-static-8.42-6.el8.s390x.rpm pcre-tools-debuginfo-8.42-6.el8.s390x.rpm pcre-utf16-debuginfo-8.42-6.el8.s390x.rpm pcre-utf32-debuginfo-8.42-6.el8.s390x.rpm x86_64: pcre-cpp-debuginfo-8.42-6.el8.i686.rpm pcre-cpp-debuginfo-8.42-6.el8.x86_64.rpm pcre-debuginfo-8.42-6.el8.i686.rpm pcre-debuginfo-8.42-6.el8.x86_64.rpm pcre-debugsource-8.42-6.el8.i686.rpm pcre-debugsource-8.42-6.el8.x86_64.rpm pcre-static-8.42-6.el8.i686.rpm pcre-static-8.42-6.el8.x86_64.rpm pcre-tools-debuginfo-8.42-6.el8.i686.rpm pcre-tools-debuginfo-8.42-6.el8.x86_64.rpm pcre-utf16-debuginfo-8.42-6.el8.i686.rpm pcre-utf16-debuginfo-8.42-6.el8.x86_64.rpm pcre-utf32-debuginfo-8.42-6.el8.i686.rpm pcre-utf32-debuginfo-8.42-6.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-20838 https://access.redhat.com/security/cve/CVE-2020-14155 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYrcdNzjgjWX9erEAQgdyQ//XAuG8KcO4FdYe2I6q9tw6IVmYvzSgx5M qfoCy5NXZjw7mMZnoNhpDb7EIwHXpEuscSfn29LjPpEeAo2oJkBCOdkTzhuaiH4w c2yy2gu1W2RQ9gbKu16qBjIGNsAb/uvMujgPgA32sLtvlBy1EXGD3IslpQx/pyjZ PhKnxvt41RhmbzePHBJCDUtZNviy19TZVIR2YcrsYZ0B3k5SZ4IiEcX9YMgVU3z2 Xnh2uFscv29O6oTn8uQ54NhrDs1PA/cH5rjnzQxsO7+P+uwKTqCqM1lmMbnK5vkS FbRgIAJp+8RUUqHPXCwCC61ScgqW2Mn6IWn2yind3isYZAofQhaO3EdSPuiyFsGy zvpeKTGvh9uUnaPCpJMMzzHIIMix10AZBfP0gZYmpaTI2vk2gnpMWtpu/sSStlPk 95mXAygms+yyq1x0KxVOCMS8FONaFCZXs5cuGaj3Tviy0sM0JnVKyIUE/P44ETcT mqC5RA7cQn4MTfjmG87ub73Vc+xhjM5luZkf4uF5j5eMnECnD4qVOZCHhYwW9ess iiVsQ1lkT2iZVfcHEnqzOTvgFJRXwsdiBhESTgNb+JfPO3wnvtpukqcdqk6ALur/ cXvCOK+FCPrVauoBtKmcBBw7q7i0ixe9XW0O+AUqOD99xDWdqDUjoZd9RTVpTaTG Kk1mDB29RxQ=gdqn -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Description: Red Hat Advanced Cluster Management for Kubernetes 2.2.10 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console — with security policy built in. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.2/html/release_notes/ Security fixes: * CVE-2021-3795 semver-regex: inefficient regular expression complexity * CVE-2021-23440 nodejs-set-value: type confusion allows bypass of CVE-2019-10747 Related bugs: * RHACM 2.2.10 images (Bugzilla #2013652) 3. Bugs fixed (https://bugzilla.redhat.com/): 2004944 - CVE-2021-23440 nodejs-set-value: type confusion allows bypass of CVE-2019-10747 2006009 - CVE-2021-3795 semver-regex: inefficient regular expression complexity 2013652 - RHACM 2.2.10 images 5. Summary: The Migration Toolkit for Containers (MTC) 1.5.2 is now available. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Bugs fixed (https://bugzilla.redhat.com/): 2000734 - CVE-2021-3757 nodejs-immer: prototype pollution may lead to DoS or remote code execution 2005438 - Combining Rsync and Stunnel in a single pod can degrade performance (1.5 backport) 2006842 - MigCluster CR remains in "unready" state and source registry is inaccessible after temporary shutdown of source cluster 2007429 - "oc describe" and "oc log" commands on "Migration resources" tree cannot be copied after failed migration 2022017 - CVE-2021-3948 mig-controller: incorrect namespaces handling may lead to not authorized usage of Migration Toolkit for Containers (MTC) 5. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release adds the new Apache HTTP Server 2.4.37 Service Pack 10 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Service Pack 9 and includes bug fixes and enhancements. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

input validation error

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2025-04-01T21:19:00.968000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE