🟡 Medium | Source: Microsoft Security Response Center
A vulnerability in the GNU C Library (glibc) versions up to 2.29 allows an attacker to trigger uncontrolled recursion in the regular expression engine, potentially causing a stack overflow and application crash. This denial-of-service flaw affects any service or application linked against a vulnerable version of glibc, which is ubiquitous across Linux-based systems including those running on Azure. Microsoft has published information regarding this CVE in the context of its Azure services.
Security Architect’s Take: Audit Linux-based Azure workloads — including VMs, containers, and managed services — for glibc versions at or below 2.29, and apply OS or package-level updates to upgrade glibc. Pay particular attention to container base images, as these are a common source of outdated library versions that bypass standard patching processes.
Original advisory: CVE-2019-9192 In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion