Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-19334
Vulnerability from cvelistv5
Published
2019-12-06 15:22
Modified
2024-08-05 02:16
Severity ?
EPSS score ?
Summary
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.
References
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T02:16:46.899Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", }, { name: "FEDORA-2019-dfe0b42bc5", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/", }, { name: "FEDORA-2019-9d83929ffa", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/", }, { name: "RHSA-2019:4360", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "libyang", vendor: "Red Hat", versions: [ { status: "affected", version: "libyang all versions before 1.0-r5", }, ], }, ], descriptions: [ { lang: "en", value: "In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.", }, ], metrics: [ { cvssV3_0: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "CWE-121", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2019-12-23T07:06:05", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", }, { name: "FEDORA-2019-dfe0b42bc5", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/", }, { name: "FEDORA-2019-9d83929ffa", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/", }, { name: "RHSA-2019:4360", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2019-19334", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "libyang", version: { version_data: [ { version_value: "libyang all versions before 1.0-r5", }, ], }, }, ], }, vendor_name: "Red Hat", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.", }, ], }, impact: { cvss: [ [ { vectorString: "8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, ], ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-121", }, ], }, ], }, references: { reference_data: [ { name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", refsource: "CONFIRM", url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", }, { name: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", refsource: "CONFIRM", url: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", }, { name: "FEDORA-2019-dfe0b42bc5", refsource: "FEDORA", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/", }, { name: "FEDORA-2019-9d83929ffa", refsource: "FEDORA", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/", }, { name: "RHSA-2019:4360", refsource: "REDHAT", url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2019-19334", datePublished: "2019-12-06T15:22:19", dateReserved: "2019-11-27T00:00:00", dateUpdated: "2024-08-05T02:16:46.899Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2019-19334\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2019-12-06T16:15:10.920\",\"lastModified\":\"2024-11-21T04:34:35.840\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type \\\"identityref\\\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.\"},{\"lang\":\"es\",\"value\":\"En todas las versiones de libyang anteriores a 1.0-r5, se detectó un desbordamiento del búfer en la región heap de la memoria en la manera en que libyang analiza los archivos YANG con una hoja de tipo \\\"identityref\\\". Una aplicación que usa libyang para analizar archivos YANG no confiables puede ser vulnerable a este fallo, lo que permitiría a un atacante causar una denegación de servicio o posiblemente conseguir la ejecución de código.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-121\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"65E91322-5F67-43C2-8112-5ECAEC2A3C12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"80A88DE4-93F8-40C3-AA52-A5F353F028AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"05C120CA-50EF-4B6D-92C9-ED736219DB07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"99D1FA55-3F56-4E09-B41E-B05C199B96B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"35D48EC4-58D2-49C6-8049-920787733587\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B57F3953-49D6-413C-A4AE-03125935FC77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD62411F-A524-4E80-B540-780EA39CB6A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FEF091B1-978A-4881-B1FC-6848CD1A7BBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C50D690-9A4D-4B78-BF4E-A4D9B4074216\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"124A5D30-7451-4516-9AA2-963AE62DD679\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C260D13B-82E9-4596-9116-61073B42D661\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:1.0:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F8D5FC0-959E-4014-9CB7-91378CC8B2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:1.0:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCBDA519-805B-4193-8092-75E2748A7BC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:1.0:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"4653ED0D-1E48-4E56-ACA4-0475C9568A89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:1.0:r4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0BEE023-C83B-4465-97BC-8E15627025D1\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2019:4360\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:4360\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}", }, }
rhsa-2019:4360
Vulnerability from csaf_redhat
Published
2019-12-23 08:55
Modified
2024-11-22 14:19
Summary
Red Hat Security Advisory: libyang security update
Notes
Topic
An update for libyang is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The libyang package provides a library for YANG data modeling language. libyang is a YANG data modelling language parser and toolkit written (and providing API) in C. The library is used e.g. in libnetconf2, Netopeer2, sysrepo and FRRouting projects.
Security Fix(es):
* libyang: stack-based buffer overflow in make_canonical when bits leaf type is used (CVE-2019-19333)
* libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used (CVE-2019-19334)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
IMPORTANT:
The libyang-devel sub-package has recently been removed from the AppStream repository. If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for libyang is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The libyang package provides a library for YANG data modeling language. libyang is a YANG data modelling language parser and toolkit written (and providing API) in C. The library is used e.g. in libnetconf2, Netopeer2, sysrepo and FRRouting projects.\n\nSecurity Fix(es):\n\n* libyang: stack-based buffer overflow in make_canonical when bits leaf type is used (CVE-2019-19333)\n\n* libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used (CVE-2019-19334)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nIMPORTANT:\n\nThe libyang-devel sub-package has recently been removed from the AppStream repository. If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:4360", url: "https://access.redhat.com/errata/RHSA-2019:4360", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "1779573", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779573", }, { category: "external", summary: "1779576", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779576", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4360.json", }, ], title: "Red Hat Security Advisory: libyang security update", tracking: { current_release_date: "2024-11-22T14:19:14+00:00", generator: { date: "2024-11-22T14:19:14+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2019:4360", initial_release_date: "2019-12-23T08:55:03+00:00", revision_history: [ { date: "2019-12-23T08:55:03+00:00", number: "1", summary: "Initial version", }, { date: "2019-12-23T08:55:03+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T14:19:14+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 8)", product: { name: "Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:8::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=i686", }, }, }, ], category: "architecture", name: "i686", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.src", product: { name: "libyang-0:0.16.105-3.el8_1.2.src", product_id: "libyang-0:0.16.105-3.el8_1.2.src", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=src", }, }, }, ], category: "architecture", name: "src", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.src", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Riccardo Schirone", ], organization: "Red Hat Product Security", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2019-19333", cwe: { id: "CWE-121", name: "Stack-based Buffer Overflow", }, discovery_date: "2019-12-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1779573", }, ], notes: [ { category: "description", text: "A stack-based buffer overflow flaw was discovered in the way libyang parses YANG files with a leaf of type \"bits\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or execute code.", title: "Vulnerability description", }, { category: "summary", text: "libyang: stack-based buffer overflow in make_canonical when bits leaf type is used", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-19333", }, { category: "external", summary: "RHBZ#1779573", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779573", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-19333", url: "https://www.cve.org/CVERecord?id=CVE-2019-19333", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-19333", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-19333", }, ], release_date: "2019-12-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-12-23T08:55:03+00:00", details: "If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "libyang: stack-based buffer overflow in make_canonical when bits leaf type is used", }, { acknowledgments: [ { names: [ "Riccardo Schirone", ], organization: "Red Hat Product Security", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2019-19334", cwe: { id: "CWE-121", name: "Stack-based Buffer Overflow", }, discovery_date: "2019-12-04T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1779576", }, ], notes: [ { category: "description", text: "A stack-based buffer overflow flaw was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or execute code.", title: "Vulnerability description", }, { category: "summary", text: "libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-19334", }, { category: "external", summary: "RHBZ#1779576", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779576", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-19334", url: "https://www.cve.org/CVERecord?id=CVE-2019-19334", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-19334", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-19334", }, ], release_date: "2019-12-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-12-23T08:55:03+00:00", details: "If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used", }, ], }
RHSA-2019:4360
Vulnerability from csaf_redhat
Published
2019-12-23 08:55
Modified
2024-11-22 14:19
Summary
Red Hat Security Advisory: libyang security update
Notes
Topic
An update for libyang is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The libyang package provides a library for YANG data modeling language. libyang is a YANG data modelling language parser and toolkit written (and providing API) in C. The library is used e.g. in libnetconf2, Netopeer2, sysrepo and FRRouting projects.
Security Fix(es):
* libyang: stack-based buffer overflow in make_canonical when bits leaf type is used (CVE-2019-19333)
* libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used (CVE-2019-19334)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
IMPORTANT:
The libyang-devel sub-package has recently been removed from the AppStream repository. If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for libyang is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The libyang package provides a library for YANG data modeling language. libyang is a YANG data modelling language parser and toolkit written (and providing API) in C. The library is used e.g. in libnetconf2, Netopeer2, sysrepo and FRRouting projects.\n\nSecurity Fix(es):\n\n* libyang: stack-based buffer overflow in make_canonical when bits leaf type is used (CVE-2019-19333)\n\n* libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used (CVE-2019-19334)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nIMPORTANT:\n\nThe libyang-devel sub-package has recently been removed from the AppStream repository. If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:4360", url: "https://access.redhat.com/errata/RHSA-2019:4360", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "1779573", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779573", }, { category: "external", summary: "1779576", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779576", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4360.json", }, ], title: "Red Hat Security Advisory: libyang security update", tracking: { current_release_date: "2024-11-22T14:19:14+00:00", generator: { date: "2024-11-22T14:19:14+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2019:4360", initial_release_date: "2019-12-23T08:55:03+00:00", revision_history: [ { date: "2019-12-23T08:55:03+00:00", number: "1", summary: "Initial version", }, { date: "2019-12-23T08:55:03+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T14:19:14+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 8)", product: { name: "Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:8::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=i686", }, }, }, ], category: "architecture", name: "i686", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.src", product: { name: "libyang-0:0.16.105-3.el8_1.2.src", product_id: "libyang-0:0.16.105-3.el8_1.2.src", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=src", }, }, }, ], category: "architecture", name: "src", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.src", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Riccardo Schirone", ], organization: "Red Hat Product Security", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2019-19333", cwe: { id: "CWE-121", name: "Stack-based Buffer Overflow", }, discovery_date: "2019-12-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1779573", }, ], notes: [ { category: "description", text: "A stack-based buffer overflow flaw was discovered in the way libyang parses YANG files with a leaf of type \"bits\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or execute code.", title: "Vulnerability description", }, { category: "summary", text: "libyang: stack-based buffer overflow in make_canonical when bits leaf type is used", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-19333", }, { category: "external", summary: "RHBZ#1779573", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779573", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-19333", url: "https://www.cve.org/CVERecord?id=CVE-2019-19333", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-19333", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-19333", }, ], release_date: "2019-12-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-12-23T08:55:03+00:00", details: "If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "libyang: stack-based buffer overflow in make_canonical when bits leaf type is used", }, { acknowledgments: [ { names: [ "Riccardo Schirone", ], organization: "Red Hat Product Security", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2019-19334", cwe: { id: "CWE-121", name: "Stack-based Buffer Overflow", }, discovery_date: "2019-12-04T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1779576", }, ], notes: [ { category: "description", text: "A stack-based buffer overflow flaw was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or execute code.", title: "Vulnerability description", }, { category: "summary", text: "libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-19334", }, { category: "external", summary: "RHBZ#1779576", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779576", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-19334", url: "https://www.cve.org/CVERecord?id=CVE-2019-19334", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-19334", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-19334", }, ], release_date: "2019-12-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-12-23T08:55:03+00:00", details: "If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used", }, ], }
rhsa-2019_4360
Vulnerability from csaf_redhat
Published
2019-12-23 08:55
Modified
2024-11-22 14:19
Summary
Red Hat Security Advisory: libyang security update
Notes
Topic
An update for libyang is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The libyang package provides a library for YANG data modeling language. libyang is a YANG data modelling language parser and toolkit written (and providing API) in C. The library is used e.g. in libnetconf2, Netopeer2, sysrepo and FRRouting projects.
Security Fix(es):
* libyang: stack-based buffer overflow in make_canonical when bits leaf type is used (CVE-2019-19333)
* libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used (CVE-2019-19334)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
IMPORTANT:
The libyang-devel sub-package has recently been removed from the AppStream repository. If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for libyang is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The libyang package provides a library for YANG data modeling language. libyang is a YANG data modelling language parser and toolkit written (and providing API) in C. The library is used e.g. in libnetconf2, Netopeer2, sysrepo and FRRouting projects.\n\nSecurity Fix(es):\n\n* libyang: stack-based buffer overflow in make_canonical when bits leaf type is used (CVE-2019-19333)\n\n* libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used (CVE-2019-19334)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nIMPORTANT:\n\nThe libyang-devel sub-package has recently been removed from the AppStream repository. If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:4360", url: "https://access.redhat.com/errata/RHSA-2019:4360", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "1779573", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779573", }, { category: "external", summary: "1779576", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779576", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4360.json", }, ], title: "Red Hat Security Advisory: libyang security update", tracking: { current_release_date: "2024-11-22T14:19:14+00:00", generator: { date: "2024-11-22T14:19:14+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2019:4360", initial_release_date: "2019-12-23T08:55:03+00:00", revision_history: [ { date: "2019-12-23T08:55:03+00:00", number: "1", summary: "Initial version", }, { date: "2019-12-23T08:55:03+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T14:19:14+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 8)", product: { name: "Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:8::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=i686", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=i686", }, }, }, ], category: "architecture", name: "i686", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=s390x", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debugsource@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-cpp-debuginfo@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_id: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/libyang-debuginfo@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, { category: "product_version", name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_id: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/python3-libyang-debuginfo@0.16.105-3.el8_1.2?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "libyang-0:0.16.105-3.el8_1.2.src", product: { name: "libyang-0:0.16.105-3.el8_1.2.src", product_id: "libyang-0:0.16.105-3.el8_1.2.src", product_identification_helper: { purl: "pkg:rpm/redhat/libyang@0.16.105-3.el8_1.2?arch=src", }, }, }, ], category: "architecture", name: "src", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.src", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, { category: "default_component_of", full_product_name: { name: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", }, product_reference: "python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.MAIN.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Riccardo Schirone", ], organization: "Red Hat Product Security", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2019-19333", cwe: { id: "CWE-121", name: "Stack-based Buffer Overflow", }, discovery_date: "2019-12-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1779573", }, ], notes: [ { category: "description", text: "A stack-based buffer overflow flaw was discovered in the way libyang parses YANG files with a leaf of type \"bits\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or execute code.", title: "Vulnerability description", }, { category: "summary", text: "libyang: stack-based buffer overflow in make_canonical when bits leaf type is used", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-19333", }, { category: "external", summary: "RHBZ#1779573", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779573", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-19333", url: "https://www.cve.org/CVERecord?id=CVE-2019-19333", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-19333", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-19333", }, ], release_date: "2019-12-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-12-23T08:55:03+00:00", details: "If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "libyang: stack-based buffer overflow in make_canonical when bits leaf type is used", }, { acknowledgments: [ { names: [ "Riccardo Schirone", ], organization: "Red Hat Product Security", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2019-19334", cwe: { id: "CWE-121", name: "Stack-based Buffer Overflow", }, discovery_date: "2019-12-04T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1779576", }, ], notes: [ { category: "description", text: "A stack-based buffer overflow flaw was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or execute code.", title: "Vulnerability description", }, { category: "summary", text: "libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-19334", }, { category: "external", summary: "RHBZ#1779576", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1779576", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-19334", url: "https://www.cve.org/CVERecord?id=CVE-2019-19334", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-19334", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-19334", }, ], release_date: "2019-12-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-12-23T08:55:03+00:00", details: "If you have previously installed libyang-devel, remove it prior to applying this advisory to make the update successful.\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.src", "AppStream-8.1.0.Z.MAIN.EUS:libyang-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-cpp-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:libyang-debugsource-0:0.16.105-3.el8_1.2.x86_64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.aarch64", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.i686", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.ppc64le", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.s390x", "AppStream-8.1.0.Z.MAIN.EUS:python3-libyang-debuginfo-0:0.16.105-3.el8_1.2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used", }, ], }
ghsa-936c-h6q8-79c4
Vulnerability from github
Published
2022-05-24 17:02
Modified
2024-04-04 02:42
Severity ?
Details
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.
{ affected: [], aliases: [ "CVE-2019-19334", ], database_specific: { cwe_ids: [ "CWE-121", "CWE-787", ], github_reviewed: false, github_reviewed_at: null, nvd_published_at: "2019-12-06T16:15:00Z", severity: "CRITICAL", }, details: "In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.", id: "GHSA-936c-h6q8-79c4", modified: "2024-04-04T02:42:13Z", published: "2022-05-24T17:02:48Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-19334", }, { type: "WEB", url: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2019:4360", }, { type: "WEB", url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", }, { type: "WEB", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ", }, { type: "WEB", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL", }, { type: "WEB", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ", }, { type: "WEB", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL", }, ], schema_version: "1.4.0", severity: [ { score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", type: "CVSS_V3", }, ], }
fkie_cve-2019-19334
Vulnerability from fkie_nvd
Published
2019-12-06 16:15
Modified
2024-11-21 04:34
Severity ?
Summary
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.
References
Impacted products
Vendor | Product | Version | |
---|---|---|---|
cesnet | libyang | 0.11 | |
cesnet | libyang | 0.11 | |
cesnet | libyang | 0.12 | |
cesnet | libyang | 0.12 | |
cesnet | libyang | 0.13 | |
cesnet | libyang | 0.13 | |
cesnet | libyang | 0.14 | |
cesnet | libyang | 0.15 | |
cesnet | libyang | 0.16 | |
cesnet | libyang | 0.16 | |
cesnet | libyang | 0.16 | |
cesnet | libyang | 1.0 | |
cesnet | libyang | 1.0 | |
cesnet | libyang | 1.0 | |
cesnet | libyang | 1.0 | |
redhat | enterprise_linux | 8.0 | |
fedoraproject | fedora | 31 |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*", matchCriteriaId: "65E91322-5F67-43C2-8112-5ECAEC2A3C12", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*", matchCriteriaId: "80A88DE4-93F8-40C3-AA52-A5F353F028AA", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*", matchCriteriaId: "05C120CA-50EF-4B6D-92C9-ED736219DB07", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*", matchCriteriaId: "99D1FA55-3F56-4E09-B41E-B05C199B96B8", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*", matchCriteriaId: "35D48EC4-58D2-49C6-8049-920787733587", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*", matchCriteriaId: "B57F3953-49D6-413C-A4AE-03125935FC77", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*", matchCriteriaId: "DD62411F-A524-4E80-B540-780EA39CB6A4", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*", matchCriteriaId: "FEF091B1-978A-4881-B1FC-6848CD1A7BBF", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*", matchCriteriaId: "0C50D690-9A4D-4B78-BF4E-A4D9B4074216", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*", matchCriteriaId: "124A5D30-7451-4516-9AA2-963AE62DD679", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*", matchCriteriaId: "C260D13B-82E9-4596-9116-61073B42D661", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:1.0:r1:*:*:*:*:*:*", matchCriteriaId: "5F8D5FC0-959E-4014-9CB7-91378CC8B2BA", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:1.0:r2:*:*:*:*:*:*", matchCriteriaId: "DCBDA519-805B-4193-8092-75E2748A7BC3", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:1.0:r3:*:*:*:*:*:*", matchCriteriaId: "4653ED0D-1E48-4E56-ACA4-0475C9568A89", vulnerable: true, }, { criteria: "cpe:2.3:a:cesnet:libyang:1.0:r4:*:*:*:*:*:*", matchCriteriaId: "F0BEE023-C83B-4465-97BC-8E15627025D1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", matchCriteriaId: "F4CFF558-3C47-480D-A2F0-BABF26042943", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*", matchCriteriaId: "80F0FA5D-8D3B-4C0E-81E2-87998286AF33", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.", }, { lang: "es", value: "En todas las versiones de libyang anteriores a 1.0-r5, se detectó un desbordamiento del búfer en la región heap de la memoria en la manera en que libyang analiza los archivos YANG con una hoja de tipo \"identityref\". Una aplicación que usa libyang para analizar archivos YANG no confiables puede ser vulnerable a este fallo, lo que permitiría a un atacante causar una denegación de servicio o posiblemente conseguir la ejecución de código.", }, ], id: "CVE-2019-19334", lastModified: "2024-11-21T04:34:35.840", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, exploitabilityScore: 2.2, impactScore: 5.9, source: "secalert@redhat.com", type: "Secondary", }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-12-06T16:15:10.920", references: [ { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2019:4360", }, { source: "secalert@redhat.com", tags: [ "Issue Tracking", "Patch", "Third Party Advisory", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", }, { source: "secalert@redhat.com", tags: [ "Patch", "Third Party Advisory", ], url: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", }, { source: "secalert@redhat.com", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/", }, { source: "secalert@redhat.com", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2019:4360", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Third Party Advisory", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Third Party Advisory", ], url: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-121", }, ], source: "secalert@redhat.com", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-787", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
gsd-2019-19334
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.
Aliases
Aliases
{ GSD: { alias: "CVE-2019-19334", description: "In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.", id: "GSD-2019-19334", references: [ "https://www.suse.com/security/cve/CVE-2019-19334.html", "https://access.redhat.com/errata/RHSA-2019:4360", "https://linux.oracle.com/cve/CVE-2019-19334.html", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2019-19334", ], details: "In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.", id: "GSD-2019-19334", modified: "2023-12-13T01:23:54.481303Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2019-19334", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "libyang", version: { version_data: [ { version_value: "libyang all versions before 1.0-r5", }, ], }, }, ], }, vendor_name: "Red Hat", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.", }, ], }, impact: { cvss: [ [ { vectorString: "8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, ], ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-121", }, ], }, ], }, references: { reference_data: [ { name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", refsource: "CONFIRM", url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", }, { name: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", refsource: "CONFIRM", url: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", }, { name: "FEDORA-2019-dfe0b42bc5", refsource: "FEDORA", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/", }, { name: "FEDORA-2019-9d83929ffa", refsource: "FEDORA", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/", }, { name: "RHSA-2019:4360", refsource: "REDHAT", url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], }, }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:1.0:r1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:1.0:r2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:1.0:r3:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:cesnet:libyang:1.0:r4:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2019-19334", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type \"identityref\". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "CWE-787", }, ], }, ], }, references: { reference_data: [ { name: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", refsource: "CONFIRM", tags: [ "Patch", "Third Party Advisory", ], url: "https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6", }, { name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", refsource: "CONFIRM", tags: [ "Issue Tracking", "Patch", "Third Party Advisory", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334", }, { name: "FEDORA-2019-dfe0b42bc5", refsource: "FEDORA", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/", }, { name: "FEDORA-2019-9d83929ffa", refsource: "FEDORA", tags: [], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/", }, { name: "RHSA-2019:4360", refsource: "REDHAT", tags: [], url: "https://access.redhat.com/errata/RHSA-2019:4360", }, ], }, }, impact: { baseMetricV2: { acInsufInfo: false, cvssV2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "HIGH", userInteractionRequired: false, }, baseMetricV3: { cvssV3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, }, }, lastModifiedDate: "2019-12-18T18:15Z", publishedDate: "2019-12-06T16:15Z", }, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.