Stack Consumption Vulnerability in libyang by CESNET
CVE-2019-20395

6.5MEDIUM

Key Information:

Vendor

Cesnet

Status
Libyang
Vendor
CVE Published:
22 January 2020

What is CVE-2019-20395?

A stack consumption issue identified in libyang versions prior to v1.0-r1 can occur due to the self-referential union type that includes leafrefs. This vulnerability poses a risk to applications utilizing libyang to process untrusted yang files, potentially leading to application crashes. Proper validation and careful handling of input are essential to mitigate the risk associated with this vulnerability.

References

https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1
https://github.com/CESNET/libyang/issues/724
https://github.com/CESNET/libyang/commit/4e610ccd87a2ba94...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.