CVE-2019-20395: Medium severity cesnet vulnerability
A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.
Other sources
A stack-overflow is present in libyang up to version v1.0-r1 due to self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.
Upstream issue: https://github.com/CESNET/libyang/issues/724
Upstream fix: https://github.com/CESNET/libyang/commit/4e610ccd87a2ba9413819777d508f71163fcc237
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-20395?
CVE-2019-20395 has a high severity level due to the potential for a stack overflow leading to application crashes.
How do I fix CVE-2019-20395?
To fix CVE-2019-20395, update libyang to version 1.0-r1 or later.
Which versions of libyang are affected by CVE-2019-20395?
CVE-2019-20395 affects libyang versions prior to 1.0-r1, including various 0.x and 0.1 versions.
What type of issue is CVE-2019-20395?
CVE-2019-20395 is a stack consumption issue that can cause crashes due to self-referential union types with leafrefs.
Who is impacted by CVE-2019-20395?
Applications that use libyang to parse untrusted YANG files are impacted by CVE-2019-20395.