CVE-2018-20796

HIGH

glibc < 2.29 - Uncontrolled Recursion in posix/regexec.c

Title source: manual
STIX 2.1

Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.

References (5)

Core 5
Core References
Patch, Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20190315-0002/
Exploit, Mailing List, Vendor Advisory x_refsource_misc
https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/107160
Exploit, Mailing List, Vendor Advisory x_refsource_misc
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141

Scores

CVSS v3 7.5
EPSS 0.0149
EPSS Percentile 81.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-674
Status published
Products (4)
gnu/glibc < 2.29
netapp/cloud_backup
netapp/ontap_select_deploy_administration_utility
netapp/steelstore_cloud_integrated_storage
Published Feb 26, 2019
Tracked Since Feb 18, 2026