CVE-2019-19334: Buffer Overflow
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.
Other sources
libyang up to version 1 release 4 has a stack-based buffer overflow in function makecanonical() in parser.c, when dealing with "identityref" types with a name longer than 511 bytes. An application that uses libyang to validate untrusted YANG files could be vulnerable to this flaw, which could be used by an attacker to cause a denial of service or possibly gain code execution.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19334?
CVE-2019-19334 has a high severity due to the potential for a stack-based buffer overflow leading to denial of service.
How do I fix CVE-2019-19334?
To mitigate CVE-2019-19334, upgrade to libyang version 1.0-r5 or later.
Which versions of libyang are affected by CVE-2019-19334?
All versions of libyang before 1.0-r5 are affected by CVE-2019-19334.
What type of vulnerability is CVE-2019-19334?
CVE-2019-19334 is a stack-based buffer overflow vulnerability.
Can CVE-2019-19334 be exploited remotely?
Yes, CVE-2019-19334 can potentially be exploited remotely by an attacker through untrusted YANG files.