Uncontrolled Recursion in libyang - CVE-2021-28903
Published: July 26, 2021
Vulnerability identifier: #VU55302
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-28903
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an uncontrolled recursion in the "lyxml_parse_elem()" function. A remote attacker can cause a denial of service condition on the target system.
Affected software
libyang
Gentoo Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
openSUSE Leap
libyang-cpp-devel
libyang-cpp1
libyang-cpp1-debuginfo
libyang-debuginfo
libyang-debugsource
libyang-devel
libyang-extentions
libyang-extentions-debuginfo
libyang1
libyang1-debuginfo
python3-yang
python3-yang-debuginfo
yang-tools
yang-tools-debuginfo
libyang-doc
Gentoo Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
openSUSE Leap
libyang-cpp-devel
libyang-cpp1
libyang-cpp1-debuginfo
libyang-debuginfo
libyang-debugsource
libyang-devel
libyang-extentions
libyang-extentions-debuginfo
libyang1
libyang1-debuginfo
python3-yang
python3-yang-debuginfo
yang-tools
yang-tools-debuginfo
libyang-doc
How to mitigate CVE-2021-28903
Install updates from vendor's website.
libyang - update to 1.0.240
libyang-cpp-devel - update to 1.0.184-150300.3.6.1
libyang-cpp1 - update to 1.0.184-150300.3.6.1
libyang-cpp1-debuginfo - update to 1.0.184-150300.3.6.1
libyang-debuginfo - update to 1.0.184-150300.3.6.1
libyang-debugsource - update to 1.0.184-150300.3.6.1
libyang-devel - update to 1.0.184-150300.3.6.1
libyang-extentions - update to 1.0.184-150300.3.6.1
libyang-extentions-debuginfo - update to 1.0.184-150300.3.6.1
libyang1 - update to 1.0.184-150300.3.6.1
libyang1-debuginfo - update to 1.0.184-150300.3.6.1
python3-yang - update to 1.0.184-150300.3.6.1
python3-yang-debuginfo - update to 1.0.184-150300.3.6.1
yang-tools - update to 1.0.184-150300.3.6.1
yang-tools-debuginfo - update to 1.0.184-150300.3.6.1
libyang-doc - update to 1.0.184-150300.3.6.1
libyang-cpp-devel - update to 1.0.184-150300.3.6.1
libyang-cpp1 - update to 1.0.184-150300.3.6.1
libyang-cpp1-debuginfo - update to 1.0.184-150300.3.6.1
libyang-debuginfo - update to 1.0.184-150300.3.6.1
libyang-debugsource - update to 1.0.184-150300.3.6.1
libyang-devel - update to 1.0.184-150300.3.6.1
libyang-extentions - update to 1.0.184-150300.3.6.1
libyang-extentions-debuginfo - update to 1.0.184-150300.3.6.1
libyang1 - update to 1.0.184-150300.3.6.1
libyang1-debuginfo - update to 1.0.184-150300.3.6.1
python3-yang - update to 1.0.184-150300.3.6.1
python3-yang-debuginfo - update to 1.0.184-150300.3.6.1
yang-tools - update to 1.0.184-150300.3.6.1
yang-tools-debuginfo - update to 1.0.184-150300.3.6.1
libyang-doc - update to 1.0.184-150300.3.6.1