libyang up to 1.0-r4 YANG Parser stack-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in libyang up to 1.0-r4. This issue affects some unknown processing of the component YANG Parser. Such manipulation leads to stack-based overflow. This vulnerability is traded as CVE-2019-19333. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in libyang up to 1.0-r4. It has been rated as critical. Affected by this issue is an unknown part of the component YANG Parser. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. CVE summarizes:

In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.

The weakness was shared 12/06/2019 as not defined bug report (Bugzilla). The advisory is shared for download at bugzilla.redhat.com. This vulnerability is handled as CVE-2019-19333 since 11/27/2019. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 236734 (Alibaba Cloud Linux 3 : 0076: libyang (ALINUX3-SA-2022:0076)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.0-r5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236734). The entry VDB-146745 is related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• libyang

Version

• 1.0-r4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion