Back to Database
Status published
Medium
CVE-2019-20398
A NULL pointer dereference is present in libyang before v1.0-r3...
Vulnerability Description
A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-20398
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3
- https://github.com/CESNET/libyang/commit/7852b272ef77f8098c35deea6c6f09cb78176f08
- https://github.com/CESNET/libyang/issues/773
- https://bugzilla.redhat.com/show_bug.cgi?id=1793935
- https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
More from cesnet
View All →CVE-2021-28906
In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check...
High
7.5
CVE-2021-28905
In function lys_node_free() in libyang <= v1.0.225, it asserts that...
High
7.5
CVE-2021-28904
In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check...
High
7.5
CVE-2021-28903
A stack overflow in libyang <= v1.0.225 can cause a...
High
7.5
CVE-2021-28902
In function read_yin_container() in libyang <= v1.0.225, it doesn't check...
High
7.5
Affected Vendor
cesnet
View all reports →Affected Software
libyang
Vulnerable Versions:
0.11, 0.12, 0.13, 0.14, 0.15, 0.16, 1.0
Timeline
Official Publish:
January 22nd, 2020
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.