CVE-2019-20393: Double Free
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
Other sources
A double-free is present in libyang up to version v1.0-r1 in function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
Upstream issue: https://github.com/CESNET/libyang/issues/742
Upstream fix: https://github.com/CESNET/libyang/commit/d9feacc4a590d35dbc1af21caf9080008b4450ed
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-20393?
CVE-2019-20393 has a high severity due to the potential for crashes or remote code execution.
How do I fix CVE-2019-20393?
To fix CVE-2019-20393, upgrade libyang to version 1.0-r1 or later.
Which software is affected by CVE-2019-20393?
CVE-2019-20393 affects multiple versions of libyang, specifically prior to version 1.0-r1.
Can untrusted input yang files trigger CVE-2019-20393?
Yes, untrusted input yang files can exploit CVE-2019-20393 and lead to a double-free vulnerability.
What type of vulnerability is CVE-2019-20393?
CVE-2019-20393 is a double-free vulnerability occurring in the libyang library.