CVE-2019-20395 - libyang: stack-overflow when parsing yang files with self-referential union types

Back Back to CVE browser

MEDIUM

libyang: stack-overflow when parsing yang files with self-referential union types

Published Jan 22, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 1.85%

Description

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

Affected products

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	libyang-0:1.0.184-1.el8	Fixed	RHEA-2021:1906

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-674

References (9)

https://access.redhat.com/security/cve/CVE-2019-20395
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1793924
Issue TrackingThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10945
Advisory
https://github.com/CESNET/libyang/commit/4e610ccd87a2ba9413819777d508f71163fcc237
Third Party Advisory
https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1
Third Party Advisory
https://github.com/CESNET/libyang/issues/724
ExploitThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
mailing-list
https://nvd.nist.gov/vuln/detail/CVE-2019-20395
https://www.cve.org/CVERecord?id=CVE-2019-20395

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-20395		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1793924		Issue TrackingThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10945		Advisory
https://github.com/CESNET/libyang/commit/4e610ccd87a2ba9413819777d508f71163fcc237		Third Party Advisory
https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1		Third Party Advisory
https://github.com/CESNET/libyang/issues/724		ExploitThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html		mailing-list
https://nvd.nist.gov/vuln/detail/CVE-2019-20395
https://www.cve.org/CVERecord?id=CVE-2019-20395