CVE-2021-28903: High severity CESNET libyang vulnerability
A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxmlparsemem(). lyxmlparseelem() function will be called recursively, which will consume stack space and lead to crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/libyangto a version that resolves this vulnerability.Fixed in 1.0.184-r1 - Upgrade
Upgrade
alpine/libyangto a version that resolves this vulnerability.Fixed in 1.0.215-r1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-28903?
CVE-2021-28903 has been classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2021-28903?
To fix CVE-2021-28903, upgrade libyang to a version greater than 1.0.225.
What impact does CVE-2021-28903 have on systems using libyang?
CVE-2021-28903 can lead to a denial of service by crashing applications that depend on libyang due to a stack overflow.
Is CVE-2021-28903 exploitable remotely?
Yes, CVE-2021-28903 can be exploited remotely if the vulnerable libyang library is used in a network-facing application.
What versions of libyang are affected by CVE-2021-28903?
CVE-2021-28903 affects all versions of libyang up to and including 1.0.225.