Buffer overflow in libyang - CVE-2019-20392
Published: January 22, 2020 / Updated: August 8, 2020
Vulnerability identifier: #VU34862
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-20392
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.
Affected software
libyang
Dell EMC PowerProtect Data Protection
SmartFabric OS10
Red Hat Enterprise Linux for x86_64
libyang (Red Hat package)
Dell EMC PowerProtect Data Protection
SmartFabric OS10
Red Hat Enterprise Linux for x86_64
libyang (Red Hat package)
How to mitigate CVE-2019-20392
Install update from vendor's website.
Dell EMC PowerProtect Data Protection - update to 2.7.8
SmartFabric OS10 - addressed in versions 10.5.5.9, 10.5.6.1
libyang (Red Hat package) - update to 1.0.184-1.el8
SmartFabric OS10 - addressed in versions 10.5.5.9, 10.5.6.1
libyang (Red Hat package) - update to 1.0.184-1.el8