UBUNTU-CVE-2022-24713

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2022-24713
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-24713.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-24713
Upstream
Downstream
Related
Published
2022-03-08T19:15:00Z
Modified
2025-09-08T16:50:03Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes.

References

Affected packages

Ubuntu:18.04:LTS / firefox

Package

Name
firefox
Purl
pkg:deb/ubuntu/firefox@99.0+build2-0ubuntu0.18.04.2?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
99.0+build2-0ubuntu0.18.04.2

Affected versions

56.*

56.0+build6-0ubuntu1

57.*

57.0.1+build2-0ubuntu1

59.*

59.0.1+build1-0ubuntu1
59.0.2+build1-0ubuntu1

60.*

60.0+build2-0ubuntu1
60.0.1+build2-0ubuntu0.18.04.1
60.0.2+build1-0ubuntu0.18.04.1

61.*

61.0+build3-0ubuntu0.18.04.1
61.0.1+build1-0ubuntu0.18.04.1

62.*

62.0+build2-0ubuntu0.18.04.3
62.0+build2-0ubuntu0.18.04.4
62.0+build2-0ubuntu0.18.04.5
62.0.3+build1-0ubuntu0.18.04.1

63.*

63.0+build2-0ubuntu0.18.04.2
63.0.3+build1-0ubuntu0.18.04.1

64.*

64.0+build3-0ubuntu0.18.04.1

65.*

65.0+build2-0ubuntu0.18.04.1
65.0.1+build2-0ubuntu0.18.04.1

66.*

66.0+build3-0ubuntu0.18.04.1
66.0.1+build1-0ubuntu0.18.04.1
66.0.2+build1-0ubuntu0.18.04.1
66.0.3+build1-0ubuntu0.18.04.1
66.0.4+build3-0ubuntu0.18.04.1
66.0.5+build1-0ubuntu0.18.04.1

67.*

67.0+build2-0ubuntu0.18.04.1
67.0.1+build1-0ubuntu0.18.04.1
67.0.2+build2-0ubuntu0.18.04.1
67.0.3+build1-0ubuntu0.18.04.1
67.0.4+build1-0ubuntu0.18.04.1

68.*

68.0+build3-0ubuntu0.18.04.1
68.0.1+build1-0ubuntu0.18.04.1
68.0.2+build1-0ubuntu0.18.04.1

69.*

69.0+build2-0ubuntu0.18.04.1
69.0.1+build1-0ubuntu0.18.04.1
69.0.2+build1-0ubuntu0.18.04.1

70.*

70.0+build2-0ubuntu0.18.04.1
70.0.1+build1-0ubuntu0.18.04.1

71.*

71.0+build5-0ubuntu0.18.04.1

72.*

72.0.1+build1-0ubuntu0.18.04.1
72.0.2+build1-0ubuntu0.18.04.1

73.*

73.0+build3-0ubuntu0.18.04.1
73.0.1+build1-0ubuntu0.18.04.1

74.*

74.0+build3-0ubuntu0.18.04.1
74.0.1+build1-0ubuntu0.18.04.1

75.*

75.0+build3-0ubuntu0.18.04.1

76.*

76.0+build2-0ubuntu0.18.04.1
76.0.1+build1-0ubuntu0.18.04.1

77.*

77.0.1+build1-0ubuntu0.18.04.1

78.*

78.0.1+build1-0ubuntu0.18.04.1
78.0.2+build2-0ubuntu0.18.04.1

79.*

79.0+build1-0ubuntu0.18.04.1

80.*

80.0+build2-0ubuntu0.18.04.1
80.0.1+build1-0ubuntu0.18.04.1

81.*

81.0+build2-0ubuntu0.18.04.1
81.0.2+build1-0ubuntu0.18.04.1

82.*

82.0+build2-0ubuntu0.18.04.1
82.0.2+build1-0ubuntu0.18.04.1
82.0.3+build1-0ubuntu0.18.04.1

83.*

83.0+build2-0ubuntu0.18.04.2

84.*

84.0+build3-0ubuntu0.18.04.1
84.0.1+build1-0ubuntu0.18.04.1
84.0.2+build1-0ubuntu0.18.04.1

85.*

85.0+build1-0ubuntu0.18.04.1
85.0.1+build1-0ubuntu0.18.04.1

86.*

86.0+build3-0ubuntu0.18.04.1
86.0.1+build1-0ubuntu0.18.04.1

87.*

87.0+build3-0ubuntu0.18.04.2

88.*

88.0+build2-0ubuntu0.18.04.2
88.0.1+build1-0ubuntu0.18.04.2

89.*

89.0+build2-0ubuntu0.18.04.2
89.0.1+build1-0ubuntu0.18.04.1
89.0.2+build1-0ubuntu0.18.04.1

90.*

90.0+build1-0ubuntu0.18.04.1
90.0.2+build1-0ubuntu0.18.04.1

91.*

91.0+build2-0ubuntu0.18.04.1
91.0.1+build1-0ubuntu0.18.04.1
91.0.2+build1-0ubuntu0.18.04.1

92.*

92.0+build3-0ubuntu0.18.04.1

93.*

93.0+build1-0ubuntu0.18.04.1

94.*

94.0+build3-0ubuntu0.18.04.1

95.*

95.0+build1-0ubuntu0.18.04.1
95.0.1+build2-0ubuntu0.18.04.1

96.*

96.0+build2-0ubuntu0.18.04.1

97.*

97.0+build2-0ubuntu0.18.04.1
97.0.2+build1-0ubuntu0.18.04.1

98.*

98.0+build3-0ubuntu0.18.04.2
98.0.1+build2-0ubuntu0.18.04.1
98.0.2+build1-0ubuntu0.18.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "firefox",
            "binary_version": "99.0+build2-0ubuntu0.18.04.2"
        },
        {
            "binary_name": "firefox-dev",
            "binary_version": "99.0+build2-0ubuntu0.18.04.2"
        },
        {
            "binary_name": "firefox-geckodriver",
            "binary_version": "99.0+build2-0ubuntu0.18.04.2"
        },
        {
            "binary_name": "firefox-mozsymbols",
            "binary_version": "99.0+build2-0ubuntu0.18.04.2"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:18.04:LTS / thunderbird

Package

Name
thunderbird
Purl
pkg:deb/ubuntu/thunderbird@1:91.8.1+build1-0ubuntu0.18.04.1?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:91.8.1+build1-0ubuntu0.18.04.1

Affected versions

1:52.*

1:52.4.0+build1-0ubuntu2
1:52.6.0+build1-0ubuntu1
1:52.7.0+build1-0ubuntu1
1:52.8.0+build1-0ubuntu0.18.04.1
1:52.9.1+build3-0ubuntu0.18.04.1

1:60.*

1:60.2.1+build1-0ubuntu0.18.04.2
1:60.4.0+build2-0ubuntu0.18.04.1
1:60.5.1+build2-0ubuntu0.18.04.1
1:60.6.1+build2-0ubuntu0.18.04.1
1:60.7.0+build1-0ubuntu0.18.04.1
1:60.7.1+build1-0ubuntu0.18.04.1
1:60.7.2+build2-0ubuntu0.18.04.1
1:60.8.0+build1-0ubuntu0.18.04.1
1:60.9.0+build1-0ubuntu0.18.04.1

1:68.*

1:68.2.1+build1-0ubuntu0.18.04.1
1:68.2.2+build1-0ubuntu0.18.04.1
1:68.4.1+build1-0ubuntu0.18.04.1
1:68.7.0+build1-0ubuntu0.18.04.1
1:68.8.0+build2-0ubuntu0.18.04.2
1:68.10.0+build1-0ubuntu0.18.04.1

1:78.*

1:78.8.1+build1-0ubuntu0.18.04.1
1:78.11.0+build1-0ubuntu0.18.04.2
1:78.13.0+build1-0ubuntu0.18.04.1
1:78.14.0+build1-0ubuntu0.18.04.1
1:78.14.0+build1-0ubuntu0.18.04.2

1:91.*

1:91.5.0+build1-0ubuntu0.18.04.1
1:91.7.0+build2-0ubuntu0.18.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "thunderbird",
            "binary_version": "1:91.8.1+build1-0ubuntu0.18.04.1"
        },
        {
            "binary_name": "thunderbird-dev",
            "binary_version": "1:91.8.1+build1-0ubuntu0.18.04.1"
        },
        {
            "binary_name": "thunderbird-gnome-support",
            "binary_version": "1:91.8.1+build1-0ubuntu0.18.04.1"
        },
        {
            "binary_name": "thunderbird-mozsymbols",
            "binary_version": "1:91.8.1+build1-0ubuntu0.18.04.1"
        },
        {
            "binary_name": "xul-ext-calendar-timezones",
            "binary_version": "1:91.8.1+build1-0ubuntu0.18.04.1"
        },
        {
            "binary_name": "xul-ext-gdata-provider",
            "binary_version": "1:91.8.1+build1-0ubuntu0.18.04.1"
        },
        {
            "binary_name": "xul-ext-lightning",
            "binary_version": "1:91.8.1+build1-0ubuntu0.18.04.1"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:20.04:LTS / firefox

Package

Name
firefox
Purl
pkg:deb/ubuntu/firefox@99.0+build2-0ubuntu0.20.04.2?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
99.0+build2-0ubuntu0.20.04.2

Affected versions

69.*

69.0.3+build1-0ubuntu1

70.*

70.0+build2-0ubuntu1
70.0+build2-0ubuntu2
70.0.1+build1-0ubuntu2

71.*

71.0+build2-0ubuntu2
71.0+build5-0ubuntu1

72.*

72.0.1+build1-0ubuntu1
72.0.2+build1-0ubuntu1

73.*

73.0+build1-0ubuntu1
73.0+build2-0ubuntu1
73.0+build3-0ubuntu1
73.0.1+build1-0ubuntu1

74.*

74.0+build1-0ubuntu1
74.0+build2-0ubuntu1
74.0+build2-0ubuntu2
74.0+build3-0ubuntu1

75.*

75.0+build3-0ubuntu1

76.*

76.0+build2-0ubuntu0.20.04.1
76.0.1+build1-0ubuntu0.20.04.1

77.*

77.0.1+build1-0ubuntu0.20.04.1

78.*

78.0.1+build1-0ubuntu0.20.04.1
78.0.2+build2-0ubuntu0.20.04.1

79.*

79.0+build1-0ubuntu0.20.04.1

80.*

80.0+build2-0ubuntu0.20.04.1
80.0.1+build1-0ubuntu0.20.04.1

81.*

81.0+build2-0ubuntu0.20.04.1
81.0.2+build1-0ubuntu0.20.04.1

82.*

82.0+build2-0ubuntu0.20.04.1
82.0.2+build1-0ubuntu0.20.04.1
82.0.3+build1-0ubuntu0.20.04.1

83.*

83.0+build2-0ubuntu0.20.04.1

84.*

84.0+build3-0ubuntu0.20.04.1
84.0.1+build1-0ubuntu0.20.04.1
84.0.2+build1-0ubuntu0.20.04.1

85.*

85.0+build1-0ubuntu0.20.04.1
85.0.1+build1-0ubuntu0.20.04.1

86.*

86.0+build3-0ubuntu0.20.04.1
86.0.1+build1-0ubuntu0.20.04.1

87.*

87.0+build3-0ubuntu0.20.04.2

88.*

88.0+build2-0ubuntu0.20.04.1
88.0.1+build1-0ubuntu0.20.04.2

89.*

89.0+build2-0ubuntu0.20.04.2
89.0.1+build1-0ubuntu0.20.04.1
89.0.2+build1-0ubuntu0.20.04.1

90.*

90.0+build1-0ubuntu0.20.04.1
90.0.2+build1-0ubuntu0.20.04.1

91.*

91.0+build2-0ubuntu0.20.04.1
91.0.1+build1-0ubuntu0.20.04.1
91.0.2+build1-0ubuntu0.20.04.1

92.*

92.0+build3-0ubuntu0.20.04.1

93.*

93.0+build1-0ubuntu0.20.04.1

94.*

94.0+build3-0ubuntu0.20.04.1

95.*

95.0+build1-0ubuntu0.20.04.1
95.0.1+build2-0ubuntu0.20.04.1

96.*

96.0+build2-0ubuntu0.20.04.1

97.*

97.0+build2-0ubuntu0.20.04.1
97.0.2+build1-0ubuntu0.20.04.1

98.*

98.0+build3-0ubuntu0.20.04.2
98.0.1+build2-0ubuntu0.20.04.1
98.0.2+build1-0ubuntu0.20.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "firefox",
            "binary_version": "99.0+build2-0ubuntu0.20.04.2"
        },
        {
            "binary_name": "firefox-dev",
            "binary_version": "99.0+build2-0ubuntu0.20.04.2"
        },
        {
            "binary_name": "firefox-geckodriver",
            "binary_version": "99.0+build2-0ubuntu0.20.04.2"
        },
        {
            "binary_name": "firefox-mozsymbols",
            "binary_version": "99.0+build2-0ubuntu0.20.04.2"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:20.04:LTS / rust-regex

Package

Name
rust-regex
Purl
pkg:deb/ubuntu/rust-regex@1.2.1-3ubuntu0.1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.1-3ubuntu0.1

Affected versions

1.*

1.2.1-3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "librust-regex-dev",
            "binary_version": "1.2.1-3ubuntu0.1"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:20.04:LTS / thunderbird

Package

Name
thunderbird
Purl
pkg:deb/ubuntu/thunderbird@1:91.8.1+build1-0ubuntu0.20.04.1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:91.8.1+build1-0ubuntu0.20.04.1

Affected versions

1:68.*

1:68.1.2+build1-0ubuntu1
1:68.1.2+build1-0ubuntu2
1:68.2.1+build1-0ubuntu1
1:68.2.2+build1-0ubuntu1
1:68.3.0+build2-0ubuntu1
1:68.3.1+build1-0ubuntu2
1:68.4.1+build1-0ubuntu1
1:68.4.2+build2-0ubuntu1
1:68.5.0+build1-0ubuntu1
1:68.6.0+build2-0ubuntu1
1:68.7.0+build1-0ubuntu1
1:68.7.0+build1-0ubuntu2
1:68.8.0+build2-0ubuntu0.20.04.2
1:68.10.0+build1-0ubuntu0.20.04.1

1:78.*

1:78.7.1+build1-0ubuntu0.20.04.1
1:78.8.1+build1-0ubuntu0.20.04.1
1:78.11.0+build1-0ubuntu0.20.04.2
1:78.13.0+build1-0ubuntu0.20.04.2
1:78.14.0+build1-0ubuntu0.20.04.1
1:78.14.0+build1-0ubuntu0.20.04.2

1:91.*

1:91.5.0+build1-0ubuntu0.20.04.1
1:91.7.0+build2-0ubuntu0.20.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "thunderbird",
            "binary_version": "1:91.8.1+build1-0ubuntu0.20.04.1"
        },
        {
            "binary_name": "thunderbird-dev",
            "binary_version": "1:91.8.1+build1-0ubuntu0.20.04.1"
        },
        {
            "binary_name": "thunderbird-gnome-support",
            "binary_version": "1:91.8.1+build1-0ubuntu0.20.04.1"
        },
        {
            "binary_name": "thunderbird-mozsymbols",
            "binary_version": "1:91.8.1+build1-0ubuntu0.20.04.1"
        },
        {
            "binary_name": "xul-ext-calendar-timezones",
            "binary_version": "1:91.8.1+build1-0ubuntu0.20.04.1"
        },
        {
            "binary_name": "xul-ext-gdata-provider",
            "binary_version": "1:91.8.1+build1-0ubuntu0.20.04.1"
        },
        {
            "binary_name": "xul-ext-lightning",
            "binary_version": "1:91.8.1+build1-0ubuntu0.20.04.1"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:22.04:LTS / firefox

Package

Name
firefox
Purl
pkg:deb/ubuntu/firefox@1:1snap1-0ubuntu1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1snap1-0ubuntu1

Affected versions

93.*

93.0+build1-0ubuntu3

94.*

94.0+build3-0ubuntu1
94.0.2+build1-0ubuntu1
94.0.2+build2-0ubuntu1

95.*

95.0+build1-0ubuntu1
95.0.1+build2-0ubuntu1
95.0.2+build1-0ubuntu1

96.*

96.0+build2-0ubuntu1
96.0.1+build1-0ubuntu1
96.0.2+build1-0ubuntu1
96.0.3+build1-0ubuntu1

97.*

97.0+build1-0ubuntu1
97.0+build2-0ubuntu1
97.0.1+build1-0ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "firefox",
            "binary_version": "1:1snap1-0ubuntu1"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:22.04:LTS / rust-regex

Package

Name
rust-regex
Purl
pkg:deb/ubuntu/rust-regex@1.5.4-1ubuntu0.1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.4-1ubuntu0.1

Affected versions

1.*

1.3.7-1
1.3.9-1
1.5.4-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "librust-regex+aho-corasick-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+default-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+memchr-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+perf-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+perf-literal-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+unicode-age-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+unicode-bool-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+unicode-case-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+unicode-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+unicode-gencat-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+unicode-perl-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+unicode-script-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex+unicode-segment-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        },
        {
            "binary_name": "librust-regex-dev",
            "binary_version": "1.5.4-1ubuntu0.1"
        }
    ],
    "availability": "No subscription required"
}