Memory Access Flaw in libyang Affects CESNET Software
CVE-2019-20391

6.5MEDIUM

Key Information:

Vendor

Cesnet

Status
Libyang
Vendor
CVE Published:
22 January 2020

What is CVE-2019-20391?

A memory access flaw exists in libyang versions prior to v1.0-r3, specifically within the resolve_feature_value() function when processing if-feature statements inside bit definitions. This vulnerability can lead to application crashes when libyang is utilized to parse untrusted YANG files, posing a significant risk to systems relying on this library for configuration management.

References

https://github.com/CESNET/libyang/commit/bdb596ddc07596fa...
https://github.com/CESNET/libyang/issues/772
https://bugzilla.redhat.com/show_bug.cgi?id=1793934

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.