Unchecked Return Value in libyang - CVE-2021-28902
Published: July 26, 2021
Vulnerability identifier: #VU55301
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-28902
CWE-ID: CWE-252
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an unchecked return value in the "read_yin_container()" function. A remote attacker can run a specially crafted program to cause a denial of service condition.
Affected software
libyang
Gentoo Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
openSUSE Leap
libyang-cpp-devel
libyang-cpp1
libyang-cpp1-debuginfo
libyang-debuginfo
libyang-debugsource
libyang-devel
libyang-extentions
libyang-extentions-debuginfo
libyang1
libyang1-debuginfo
python3-yang
python3-yang-debuginfo
yang-tools
yang-tools-debuginfo
libyang-doc
Gentoo Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
openSUSE Leap
libyang-cpp-devel
libyang-cpp1
libyang-cpp1-debuginfo
libyang-debuginfo
libyang-debugsource
libyang-devel
libyang-extentions
libyang-extentions-debuginfo
libyang1
libyang1-debuginfo
python3-yang
python3-yang-debuginfo
yang-tools
yang-tools-debuginfo
libyang-doc
How to mitigate CVE-2021-28902
Install updates from vendor's website.
libyang - update to 1.0.240
libyang-cpp-devel - update to 1.0.184-150300.3.6.1
libyang-cpp1 - update to 1.0.184-150300.3.6.1
libyang-cpp1-debuginfo - update to 1.0.184-150300.3.6.1
libyang-debuginfo - update to 1.0.184-150300.3.6.1
libyang-debugsource - update to 1.0.184-150300.3.6.1
libyang-devel - update to 1.0.184-150300.3.6.1
libyang-extentions - update to 1.0.184-150300.3.6.1
libyang-extentions-debuginfo - update to 1.0.184-150300.3.6.1
libyang1 - update to 1.0.184-150300.3.6.1
libyang1-debuginfo - update to 1.0.184-150300.3.6.1
python3-yang - update to 1.0.184-150300.3.6.1
python3-yang-debuginfo - update to 1.0.184-150300.3.6.1
yang-tools - update to 1.0.184-150300.3.6.1
yang-tools-debuginfo - update to 1.0.184-150300.3.6.1
libyang-doc - update to 1.0.184-150300.3.6.1
libyang-cpp-devel - update to 1.0.184-150300.3.6.1
libyang-cpp1 - update to 1.0.184-150300.3.6.1
libyang-cpp1-debuginfo - update to 1.0.184-150300.3.6.1
libyang-debuginfo - update to 1.0.184-150300.3.6.1
libyang-debugsource - update to 1.0.184-150300.3.6.1
libyang-devel - update to 1.0.184-150300.3.6.1
libyang-extentions - update to 1.0.184-150300.3.6.1
libyang-extentions-debuginfo - update to 1.0.184-150300.3.6.1
libyang1 - update to 1.0.184-150300.3.6.1
libyang1-debuginfo - update to 1.0.184-150300.3.6.1
python3-yang - update to 1.0.184-150300.3.6.1
python3-yang-debuginfo - update to 1.0.184-150300.3.6.1
yang-tools - update to 1.0.184-150300.3.6.1
yang-tools-debuginfo - update to 1.0.184-150300.3.6.1
libyang-doc - update to 1.0.184-150300.3.6.1