CVE-2019-9192

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as dem… (CVE-2019-9192)

Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

Source: MSRC CVELISTV5 NVD

Metrics

Severity

high

87.44

—

no public PoC known

7.5

Source: nvd-v3

CVSS v3

7.5

CVSS v4

—

EPSS percentile

83.3 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

2.4 %

Moderate — model estimates 1-10% exploitation likelihood.

Published

2019-02-26 18:00 UTC

CWE

—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

gnu
glibc2.29

References & sources

IDCVE-2019-9192