CVE-2021-28904: High severity cesnet vulnerability
Published May 20, 2021
·Updated
In function extgetplugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, extplugins[u].revision) will lead to a crash.
Affected Software
1 affected component
CESNET libyang<=1.0.225
Event History
May 20, 2021
CVE Published
via MITRE·06:36 PM
Data Sourced
via MITRE·06:36 PM
Description
Frequently Asked Questions
1
What is CVE-2021-28904?
CVE-2021-28904 is a vulnerability in function ext_get_plugin() in libyang <= v1.0.225 that can lead to a crash due to a lack of NULL value check for the revision.
2
How severe is CVE-2021-28904?
CVE-2021-28904 has a severity value of 7.5, categorized as high.
3
What software versions are affected by CVE-2021-28904?
Versions up to and including 1.0.225 of Cesnet Libyang are affected by CVE-2021-28904.
4
Is there a reference for CVE-2021-28904?
References for CVE-2021-28904 can be found at the CESNET Libyang GitHub page and the Gentoo Security Advisory.