← Back

CVE-2019-20395

nvd nist
Published: Jan 22, 2020Modified: Nov 21, 2024

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

Affected (11)

Products: Cesnet: Libyang
Cesnet
1 product
Libyang
Configuration A
11 vulnerable
Vulnerable SoftwareAffected Versions
Cesnet
Libyang
Version 0.11 r1
Libyang
Version 0.11 r2
Libyang
Version 0.12 r1
Libyang
Version 0.12 r2
Libyang
Version 0.13 r1
Libyang
Version 0.13 r2
Libyang
Version 0.14 r1
Libyang
Version 0.15 r1
Libyang
Version 0.16 r1
Libyang
Version 0.16 r2
Libyang
Version 0.16 r3

Related CWEs

CWE-674
Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (10)

Source: cve@mitre.org
Issue TrackingThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.