CVE-2022-1587: fedoraproject fedora Out-of-bounds Read
CVSS: 9.1v3.1CriticalModified
AliasesALPINE-CVE-2022-1587SUSE-SU-2022:2565-1SUSE-SU-2022:2566-1UBUNTU-CVE-2022-1587DEBIAN-CVE-2022-1587CGA-34xm-29p2-m9hpCGA-q4fg-4r2r-4m27
Published 16-05-2022Last modified 03-08-2024
Vulnerability summary
CVE-2022-1587 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in fedoraproject fedora. EPSS estimates a 2.77% chance of exploitation in the next 30 days, higher than 86.1% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (NVD)EPSS score
2.77%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 6Timeline
- 16-05-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Medium 6.4Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.77%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.77% on 20-09-2026
20-09-202620-10-2026
EPSS score2.77%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse10 products
- pcre2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 10.39-150400.4.6.1
- pcre2&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 10.34-1.10.1
- pcre2&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 10.34-1.10.1
- pcre2&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 10.34-1.10.1
- pcre2&distro=SUSE Linux Enterprise Server 12 SP5< 10.34-1.10.1
Netapp9 products
Alpine1 product
- pcre2< 10.36-r1 | < 10.40-r0
Chainguard1 product
- pcre2All versions (No fix recorded)
Debian1 product
- pcre2< 10.40-1
Fedoraproject1 product
- fedoraEOL35 | 36
Opensuse1 product
- pcre2&distro=openSUSE Leap 15.4< 10.39-150400.4.6.1
Pcre1 product
- pcre2< 10.40
Redhat1 product
Ubuntu1 product
- pcre2All versions (No fix recorded) | < 10.31-2ubuntu0.1~esm1 | < 10.34-7ubuntu0.1 | < 10.39-3ubuntu0.1
Wolfi1 product
- pcre2All versions (No fix recorded)
11 vendors · 28 products
References
19 links- lists.fedoraproject.org/archives/…Vendor Advisory
- github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0PatchThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- security.netapp.com/advisory/ntap-20221028-0009/Third Party Advisory
