CVE-2019-9192

Name of the Vulnerable Software and Affected Versions GNU C Library (aka glibc or libc6) versions prior to 2.30

Description The issue is related to Uncontrolled Recursion in the check dst limits calc pos 1 function in posix/regexec.c. This can be demonstrated by using a crafted pattern '(|)(11)*' in grep. The software maintainer disputes that this is a vulnerability, stating that the behavior occurs only with a crafted pattern.

Recommendations For GNU C Library (aka glibc or libc6) versions prior to 2.30, consider updating to a newer version to mitigate the risk of Uncontrolled Recursion. As a temporary workaround, consider restricting the use of crafted patterns in grep until a patch is available.