CVE-2019-20454

Se detectó una lectura fuera de límites en PCRE versiones anteriores a 10.34, cuando el patrón \X es compilado en JIT y usado para hacer coincidir temas especialmente diseñados en modo no UTF. Las aplicaciones que utilizan PCRE para analizar entradas no confiables pueden ser vulnerables a este fallo, lo que permitiría a un atacante bloquear la aplicación. El fallo ocurre en la función do_extuni_no_utf en el archivo pcre2_jit_compile.c.

An out-of-bounds read was discovered in PCRE when the pattern "\X" is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to crash the application.

Red Hat Advanced Cluster Management for Kubernetes 2.3.0 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs and security issues. Issues addressed include code execution, cross site scripting, denial of service, integer overflow, and null pointer vulnerabilities.