Uncontrolled Recursion in re2c - CVE-2018-21232

Vulnerability identifier: #VU31884

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-21232

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled recursion that causes stack consumption in find_fixed_tags.A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

re2c
Gentoo Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Basesystem Module
openSUSE Leap
re2c-debugsource
re2c-debuginfo
re2c
dev-util/re2c

Install updates from vendor's website.

re2c - update to 2.0
re2c-debugsource - update to 1.0.3-150000.3.3.1
re2c-debuginfo - update to 1.0.3-150000.3.3.1
re2c - update to 1.0.3-150000.3.3.1
dev-util/re2c - update to 2.0

• http://www.openwall.com/lists/oss-security/2020/05/14/4
• https://github.com/skvadrik/re2c/issues/219
• https://www.openwall.com/lists/oss-security/2020/04/27/2

• Denial of service in re2c
• SUSE update for re2c
• Gentoo update for re2c