RHEA-2021:1906

Vulnerability from csaf_opensuse - Published: 2021-05-18 00:00 - Updated: 2026-09-20 10:52
Summary
enhancement update for libyang
Severity
Low
Notes
Title of the patch: enhancement update for libyang
Description of the patch: This enhancement update provides a functional equivalent of RHEA-2021:1906. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHEA-2021:1906.
Patchnames: RHEA-2021:1906
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2019-20391
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2019-20392
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2019-20391
Threats
Impact moderate
CVE-2019-20393
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 2 products, the same list as for CVE-2019-20391
Threats
Impact important
CVE-2019-20394
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 2 products, the same list as for CVE-2019-20391
Threats
Impact important
CVE-2019-20395
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2019-20391
Threats
Impact moderate
CVE-2019-20396
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2019-20391
Threats
Impact moderate
CVE-2019-20397
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 2 products, the same list as for CVE-2019-20391
Threats
Impact important
CVE-2019-20398
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2019-20391
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "enhancement update for libyang",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This enhancement update provides a functional equivalent of RHEA-2021:1906.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHEA-2021:1906.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHEA-2021:1906",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhea-2021_1906.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-20391 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-20391/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-20392 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-20392/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-20393 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-20393/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-20394 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-20394/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-20395 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-20395/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-20396 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-20396/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-20397 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-20397/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-20398 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-20398/"
      }
    ],
    "title": "enhancement update for libyang",
    "tracking": {
      "current_release_date": "2026-09-20T10:52:27Z",
      "generator": {
        "date": "2021-05-18T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHEA-2021:1906",
      "initial_release_date": "2021-05-18T00:00:00Z",
      "revision_history": [
        {
          "date": "2021-05-18T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T10:52:27Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libyang-0:1.0.184-1.el8.i686",
                "product": {
                  "name": "libyang-0:1.0.184-1.el8.i686",
                  "product_id": "libyang-0:1.0.184-1.el8.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:cesnet:libyang:1.0.184:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libyang@1.0.184-1.el8?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libyang-0:1.0.184-1.el8.x86_64",
                "product": {
                  "name": "libyang-0:1.0.184-1.el8.x86_64",
                  "product_id": "libyang-0:1.0.184-1.el8.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:cesnet:libyang:1.0.184:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libyang@1.0.184-1.el8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang-0:1.0.184-1.el8.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686"
        },
        "product_reference": "libyang-0:1.0.184-1.el8.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang-0:1.0.184-1.el8.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
        },
        "product_reference": "libyang-0:1.0.184-1.el8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-20391",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-20391"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-20391",
          "url": "https://www.suse.com/security/cve/CVE-2019-20391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1161662 for CVE-2019-20391",
          "url": "https://bugzilla.suse.com/1161662"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-20391"
    },
    {
      "cve": "CVE-2019-20392",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-20392"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-20392",
          "url": "https://www.suse.com/security/cve/CVE-2019-20392"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1161661 for CVE-2019-20392",
          "url": "https://bugzilla.suse.com/1161661"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-20392"
    },
    {
      "cve": "CVE-2019-20393",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-20393"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-20393",
          "url": "https://www.suse.com/security/cve/CVE-2019-20393"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1161660 for CVE-2019-20393",
          "url": "https://bugzilla.suse.com/1161660"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-20393"
    },
    {
      "cve": "CVE-2019-20394",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-20394"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-20394",
          "url": "https://www.suse.com/security/cve/CVE-2019-20394"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1161659 for CVE-2019-20394",
          "url": "https://bugzilla.suse.com/1161659"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-20394"
    },
    {
      "cve": "CVE-2019-20395",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-20395"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-20395",
          "url": "https://www.suse.com/security/cve/CVE-2019-20395"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1161658 for CVE-2019-20395",
          "url": "https://bugzilla.suse.com/1161658"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-20395"
    },
    {
      "cve": "CVE-2019-20396",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-20396"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-20396",
          "url": "https://www.suse.com/security/cve/CVE-2019-20396"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-20396"
    },
    {
      "cve": "CVE-2019-20397",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-20397"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-20397",
          "url": "https://www.suse.com/security/cve/CVE-2019-20397"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1161657 for CVE-2019-20397",
          "url": "https://bugzilla.suse.com/1161657"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-20397"
    },
    {
      "cve": "CVE-2019-20398",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-20398"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
          "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-20398",
          "url": "https://www.suse.com/security/cve/CVE-2019-20398"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1161656 for CVE-2019-20398",
          "url": "https://bugzilla.suse.com/1161656"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.i686",
            "SUSE Liberty Linux 8:libyang-0:1.0.184-1.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-20398"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.