Resource exhaustion in libyang - CVE-2019-20395
Published: January 22, 2020 / Updated: August 8, 2020
Vulnerability identifier: #VU34865
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-20395
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.
Affected software
libyang
Dell EMC PowerProtect Data Protection
SmartFabric OS10
Red Hat Enterprise Linux for x86_64
libyang (Red Hat package)
Dell EMC PowerProtect Data Protection
SmartFabric OS10
Red Hat Enterprise Linux for x86_64
libyang (Red Hat package)
How to mitigate CVE-2019-20395
Install update from vendor's website.
Dell EMC PowerProtect Data Protection - update to 2.7.8
SmartFabric OS10 - addressed in versions 10.5.5.9, 10.5.6.1
libyang (Red Hat package) - update to 1.0.184-1.el8
SmartFabric OS10 - addressed in versions 10.5.5.9, 10.5.6.1
libyang (Red Hat package) - update to 1.0.184-1.el8