CVE-2019-20391

Опубликовано: 22 янв. 2020

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=1793934
Issue Tracking
Patch
Third Party Advisory
https://github.com/CESNET/libyang/commit/bdb596ddc07596fa212f231135b87d0b9178f6f8
Patch
Third Party Advisory
https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3
Third Party Advisory
https://github.com/CESNET/libyang/issues/772
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
https://bugzilla.redhat.com/show_bug.cgi?id=1793934
Issue Tracking
Patch
Third Party Advisory
https://github.com/CESNET/libyang/commit/bdb596ddc07596fa212f231135b87d0b9178f6f8
Patch
Third Party Advisory
https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3
Third Party Advisory
https://github.com/CESNET/libyang/issues/772
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:1.0:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:1.0:r2:*:*:*:*:*:*

EPSS

Процентиль: 42%

0.00203

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-119

Связанные уязвимости

CVE-2019-20391

CVSS3: 6.5

ubuntu

около 6 лет назад

CVE-2019-20391

CVSS3: 5.5

redhat

почти 7 лет назад

CVE-2019-20391

CVSS3: 6.5

debian

около 6 лет назад

An invalid memory access flaw is present in libyang before v1.0-r3 in ...

GHSA-57jg-xr2w-54jg

CVSS3: 6.5

github

больше 3 лет назад

EPSS

Процентиль: 42%

0.00203

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-119