[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <ec07456b-6a04-60a3-35e5-c266b6348530@geeklan.co.uk>
Date: Tue, 11 Apr 2023 12:22:34 +0100
From: Sevan Janiyan <venture37@...klan.co.uk>
To: oss-security@...ts.openwall.com
Subject: CVE-2017-11164 - stack exhaustion in PCRE
Hi,
CVE-2017-11164 landed some years back[1] for PCRE 8.x and is marked
up with a high base score on the article[2], yet no fix was ever listed
and is still commonly packaged, so I asked Philip Hazel (the PCRE
maintainer) regarding the issue, and this is what Philip said
"Stack exhaustion is a FEP (frequently encountered problem) in PCRE1
(the 8.xx series). There are various limiting options that the user can
apply to limit stack usage.
...
The code in PCRE2 has been re-written so as to use heap storage instead
of the stack when executing patterns, thus getting rid of a problem that
lots of people encountered with PCRE1."
"PCRE1 has become totally obsolete and is no longer maintained. The
final release was 8.45 (June 2021)"
So just a heads up if you're still linking against PCRE 8.x but software
in question supports PCRE2, perhaps it's time to switch and default to
PCRE2.
Sevan
[1] https://www.openwall.com/lists/oss-security/2017/07/11/3
[2] https://nvd.nist.gov/vuln/detail/CVE-2017-11164
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
