CVE-2022-1586: pcre2 +12 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-1586

CVSS 9.1 · Critical EPSS 3,4%

Kerentanan Out-of-bounds Read pada pcre2, fedoraproject fedora +11 lainnya. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.

Rincian

Terbit di NVD: 16 Mei 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-125: Out-of-bounds Read
EPSS (30 hari): 3,4% peluang dieksploitasi; lebih tinggi dari 88,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
pcre	pcre2	Semua versi sebelum 10.40
fedoraproject	fedora	Versi 35
fedoraproject	fedora	Versi 36
redhat	enterprise linux	Versi 8.0
redhat	enterprise linux	Versi 9.0
netapp	active iq unified manager	Semua versi
netapp	hci management node	Semua versi
netapp	ontap select deploy administration utility	Semua versi
netapp	solidfire	Semua versi
netapp	h300s firmware	Semua versi
netapp	h500s firmware	Semua versi
netapp	h700s firmware	Semua versi
netapp	h410s firmware	Semua versi
netapp	h410c firmware	Semua versi
debian	debian linux	Versi 10.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/PCRE2Project/pcre2/commit/d4fa336fbcc388f89095b184ba6d99422cfc676c patch · advisory pihak ketiga
https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a patch
https://security.netapp.com/advisory/ntap-20221028-0009/ advisory pihak ketiga
https://bugzilla.redhat.com/show_bug.cgi?id=2077976 advisory pihak ketiga
https://bugzilla.redhat.com/show_bug.cgi?id=2077976%2C broken link · issue tracking
https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a%2C broken link
https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html mailing list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6... mailing list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DIC... mailing list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7... mailing list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM... mailing list

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.