CVE-2019-19333: Buffer Overflow
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.
Other sources
libyang up to version 1 release 4 has a stack-based buffer overflow in function makecanonical() in parser.c, when dealing with "bits" types with a name longer than 511 bytes. An application that uses libyang to validate untrusted YANG files could be vulnerable to this flaw, which could be used by an attacker to cause a denial of service or possibly gain code execution.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19333?
CVE-2019-19333 is classified as a high severity vulnerability due to its potential to cause denial of service through a stack-based buffer overflow.
How do I fix CVE-2019-19333?
To fix CVE-2019-19333, update libyang to version 1.0-r5 or later.
Which versions of libyang are affected by CVE-2019-19333?
All versions of libyang prior to 1.0-r5 are affected by CVE-2019-19333.
What type of attack does CVE-2019-19333 enable?
CVE-2019-19333 enables an attacker to exploit stack-based buffer overflow vulnerabilities, potentially leading to denial of service.
Is CVE-2019-19333 specific to certain operating systems?
CVE-2019-19333 primarily affects applications using libyang across various operating systems where vulnerable versions are installed.