CVE-2019-20392: Buffer Overflow
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolvefeaturevalue() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.
Other sources
An invalid memory access flaw is present in libyang up to version v1.0-r1 in function resolvefeaturevalue() when a if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.
Upstream issue: https://github.com/CESNET/libyang/issues/723
Upstream fix: https://github.com/CESNET/libyang/commit/32fb4993bc8bb49e93e84016af3c10ea53964be5
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-20392?
CVE-2019-20392 has been classified as a high severity vulnerability due to the potential for application crashes caused by invalid memory access.
How do I fix CVE-2019-20392?
To fix CVE-2019-20392, upgrade to libyang version 1.0-r1 or later.
Which versions of libyang are affected by CVE-2019-20392?
CVE-2019-20392 affects libyang versions below 1.0-r1 as well as earlier versions like 0.11-r1 through 0.16-r3.
What happens if I don't address CVE-2019-20392?
Failing to address CVE-2019-20392 may result in application crashes when parsing untrusted YANG files.
What is libyang in relation to CVE-2019-20392?
Libyang is a YANG data modeling library that is vulnerable in certain versions, specifically due to an invalid memory access issue noted in CVE-2019-20392.