PT-2019-5896 · Oniguruma+7 · Oniguruma+7

Rkx1209 · Published 2019-07-28 · Updated 2024-02-20 · CVE-2019-16163

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oniguruma versions prior to 6.9.3

Description The issue is related to uncontrolled recursion in the Oniguruma library for regular expressions. This can lead to a stack exhaustion, potentially allowing a remote attacker to cause a denial of service.

Recommendations For versions prior to 6.9.3, update to version 6.9.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of recursive functions in regparse.c to minimize the risk of exploitation.

Exploit

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALSA-2020:3662

ALSA-2024:0889

ALT-PU-2019-2455

ALT-PU-2019-3215

BDU:2021-03616

CESA-2020_3662

CESA-2024_0889

CVE-2019-16163

DLA-1918-1

DLA-2431-1

MGASA-2020-0029

OPENSUSE-SU-2022_3327-1

RHSA-2020:3662

RHSA-2020_3662

RHSA-2024:0409

RHSA-2024:0572

RHSA-2024:0889

RHSA-2024_0889

RLSA-2020:3662

SUSE-SU-2022:3327-1

USN-4460-1

USN-5662-1

Affected Products

Alt Linux

Almalinux

Centos

Oniguruma

Red Hat

Rocky Linux

Suse

Ubuntu

References · 116

• 🔥 https://github.com/kkos/oniguruma/issues/147 · Exploit
• https://github.com/kkos/oniguruma/compare/v6.9.2...v6.9.3 · Patch
• https://github.com/kkos/oniguruma/commit/4097828d7cc87589864fecf452f2cd46c5f37180 · Patch
• https://linux.oracle.com/errata/ELSA-2020-3662.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-16163 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1918-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19204 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19246 · Vendor Advisory
• https://usn.ubuntu.com/4460-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-19203 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-16163 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3327-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19203 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=47416144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16163 · Security Note