Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-20392: libyang may crash when processing malformed YANG files

CVE-2019-20392 · published 6 years ago

Summary

The libyang library, used for reading YANG data models, can crash if it receives a file that includes an if-feature statement in a list key node that refers to an undefined feature. This issue affects versions before v1.0-r1, including the Debian libyang package. Update libyang to the latest version or avoid loading untrusted YANG files until the fix is applied.

What to do

Update debian libyang to version 1.0.176-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:13	debian	libyang	< 1.0.176-1 Fix: upgrade to 1.0.176-1
Debian:14	debian	libyang	< 1.0.176-1 Fix: upgrade to 1.0.176-1
–	cesnet	libyang	0.11 0.12 0.13 0.14 0.15 0.16 `cpe:2.3:a:cesnet:libyang:0.11:r1::::::`

Original advisory text

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not d...

References

https://security-tracker.debian.org/tracker/CVE-2019-20392 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1793922 Issue Tracking Patch Third Party Advisory
https://github.com/CESNET/libyang/commit/32fb4993bc8bb49e93e84016af3c10ea53964be... Patch Third Party Advisory
https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1 Third Party Advisory
https://github.com/CESNET/libyang/issues/723 Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published22 Jan 2020

Updated3 Nov 2026

First seen21 Sep 2026

Sources

DEBIAN-CVE-2019-20392 · OSV

CVE-2019-20392 · NVD

Track software like this

Free during beta