Lucene search

[email protected]CVE-2019-20454

HistoryFeb 14, 2020 - 2:15 p.m.

CVE-2019-20454

2020-02-1414:15:00

CWE-125

[email protected]

web.nvd.nist.gov

140

cve-2019-20454

pcre

out-of-bounds read

vulnerability

application crash

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.7 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

50.8%

JSON

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

CPENameOperatorVersion
pcre:pcre2pcre pcre2lt10.34
fedoraproject:fedorafedoraproject fedoraeq31
splunk:universal_forwardersplunk universal forwardereq9.1.0
splunk:universal_forwardersplunk universal forwarderlt9.0.6
splunk:universal_forwardersplunk universal forwarderlt8.2.12

CPE	Name	Operator	Version
pcre:pcre2	pcre pcre2	lt	10.34
fedoraproject:fedora	fedoraproject fedora	eq	31
splunk:universal_forwarder	splunk universal forwarder	eq	9.1.0
splunk:universal_forwarder	splunk universal forwarder	lt	9.0.6
splunk:universal_forwarder	splunk universal forwarder	lt	8.2.12