SB2020012249 - Multiple vulnerabilities in CESNET libyang

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020012249

SB2020012249 - Multiple vulnerabilities in CESNET libyang

Published: January 22, 2020 Updated: August 8, 2020

Security Bulletin ID SB2020012249
Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Medium 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2019-20392)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.


2) Double Free (CVE-ID: CVE-2019-20393)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.


3) Resource exhaustion (CVE-ID: CVE-2019-20395)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.


4) Input validation error (CVE-ID: CVE-2019-20396)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.


5) Double Free (CVE-ID: CVE-2019-20397)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.


Remediation

Install update from vendor's website.

References