1. CVE-Search
  2. CVE-2019-19334
ID CVE-2019-19334
Summary In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.
References
Vulnerable Configurations
  • cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:1.0:r1:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:1.0:r1:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:1.0:r2:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:1.0:r2:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:1.0:r3:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:1.0:r3:*:*:*:*:*:*
  • cpe:2.3:a:cesnet:libyang:1.0:r4:*:*:*:*:*:*
    cpe:2.3:a:cesnet:libyang:1.0:r4:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 18-12-2019 - 18:15)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
redhat via4
advisories
bugzilla
id 1779576
title CVE-2019-19334 libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 8 is installed
      oval oval:com.redhat.rhba:tst:20193384074
    • OR
      • AND
        • comment libyang is earlier than 0:0.16.105-3.el8_1.2
          oval oval:com.redhat.rhsa:tst:20194360001
        • comment libyang is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20194360002
      • AND
        • comment libyang-debugsource is earlier than 0:0.16.105-3.el8_1.2
          oval oval:com.redhat.rhsa:tst:20194360003
        • comment libyang-debugsource is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20194360004
rhsa
id RHSA-2019:4360
released 2019-12-23
severity Important
title RHSA-2019:4360: libyang security update (Important)
rpms
  • libyang-0:0.16.105-3.el8_1.2
  • libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2
  • libyang-debuginfo-0:0.16.105-3.el8_1.2
  • libyang-debugsource-0:0.16.105-3.el8_1.2
  • python3-libyang-debuginfo-0:0.16.105-3.el8_1.2
refmap via4
confirm
fedora
  • FEDORA-2019-9d83929ffa
  • FEDORA-2019-dfe0b42bc5
Last major update 18-12-2019 - 18:15
Published 06-12-2019 - 16:15
Last modified 18-12-2019 - 18:15
Back to Top