In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion
    (uncontrolled recursion) when processing a crafted regular expression. (CVE-2017-11164)

  - In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match()
    in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report,
    noting that there are options that can be used to limit the amount of stack that is used (CVE-2017-16231)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion     (uncontrolled recursion) when processing a crafted regular expression. (CVE-2017-11164)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the pcre package has been released.

- update to 2.56.x

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
424331	Alpine: multiple libpcre16 packages, multiple pcre packages: security update to 7.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424331	Alpine: multiple libpcre16 packages, multiple pcre packages: security update to 7.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
220294	Linux Distros Unpatched Vulnerability : CVE-2017-11164	Nessus	Misc.	high
121872	Photon OS 1.0: Pcre PHSA-2018-1.0-0171	Nessus	PhotonOS Local Security Checks	high
120337	Fedora 28 : mingw-glib2 / mingw-glibmm24 (2018-3238d4da59)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-11164

high

Tenable Plugins

high

high

high

high

high