CVE-2019-20395

Опубликовано: 22 янв. 2020

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=1793924
Issue Tracking
Third Party Advisory
https://github.com/CESNET/libyang/commit/4e610ccd87a2ba9413819777d508f71163fcc237
Third Party Advisory
https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1
Third Party Advisory
https://github.com/CESNET/libyang/issues/724
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
https://bugzilla.redhat.com/show_bug.cgi?id=1793924
Issue Tracking
Third Party Advisory
https://github.com/CESNET/libyang/commit/4e610ccd87a2ba9413819777d508f71163fcc237
Third Party Advisory
https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1
Third Party Advisory
https://github.com/CESNET/libyang/issues/724
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*

cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*

EPSS

Процентиль: 42%

0.00205

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-674

Связанные уязвимости

CVE-2019-20395

CVSS3: 6.5

ubuntu

около 6 лет назад

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

CVE-2019-20395

CVSS3: 5.5

redhat

почти 7 лет назад

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

CVE-2019-20395

CVSS3: 6.5

debian

около 6 лет назад

A stack consumption issue is present in libyang before v1.0-r1 due to ...

GHSA-3ffh-3h59-484g

CVSS3: 6.5

github

больше 3 лет назад

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

EPSS

Процентиль: 42%

0.00205

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-674