PT-2020-6932 · Pcre+11 · Pcre+11

Published 2020-02-12 · Updated 2024-03-27 · CVE-2020-14155

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.44

Description The issue is related to an integer overflow in the libpcre component of the PCRE library, which can be triggered by a large number after a (C substring. This can allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 8.44, update to version 8.44 to resolve the issue. As a temporary workaround, consider restricting the use of large numbers after (C substrings in regular expressions until the update is applied.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2021:4373

ALT-PU-2020-1328

ALT-PU-2020-1703

BDU:2023-07621

BIT-GITLAB-2020-14155

CESA-2021_4373

CVE-2020-14155

OPENSUSE-SU-2021:1441-1

OPENSUSE-SU-2021:3529-1

OPENSUSE-SU-2021_1441-1

OPENSUSE-SU-2021_3529-1

RHSA-2021:4373

RHSA-2021:4614

RHSA-2021_4373

RLSA-2021:4373

SUSE-SU-2021:3529-1

SUSE-SU-2021:3652-1

USN-5425-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Gitlab

Linuxmint

Apple Macos

Pcre

Red Hat

Rocky Linux

Suse

Ubuntu

References · 65

• https://osv.dev/vulnerability/SUSE-SU-2021:3652-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5425-1 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-14155 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14155 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Vendor Advisory
• https://pcre.org/original/changelog.txt · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14155 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14155 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-4373.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4373 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14155 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:3529-1 · Vendor Advisory