libyang up to 1.0-r2 lys_extension_instances_free() denial of service

A vulnerability was found in libyang up to 1.0-r2. It has been rated as problematic. This issue affects the function lys_extension_instances_free(). The manipulation with an unknown input leads to a denial of service vulnerability (NULL Pointer Dereference). Using CWE to declare the problem leads to CWE-476. Impacted is availability.

The weakness was published 01/22/2020. The identification of this vulnerability is CVE-2019-20398 since 01/22/2020. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.0-r3 eliminates this vulnerability.

Similar entries are available at 149254, 149253, 149252 and 149251.

Name

VulDB Meta Base Score: 3.5
VulDB Meta Temp Score: 3.4

VulDB Base Score: ≈3.5
VulDB Temp Score: ≈3.4
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Denial of service / NULL Pointer Dereference (CWE-476)
Local: Yes
Remote: No

Availability: 🔒
Status: Not defined

Price Prediction: 🔍
Current Price Estimation: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Upgrade: libyang 1.0-r3

01/22/2020 Advisory disclosed
01/22/2020 +0 days CVE assigned
01/23/2020 +1 days VulDB entry created
01/23/2020 +0 days VulDB last update
CVE: CVE-2019-20398 (🔒)
See also: 🔒Created: 01/23/2020 08:47 AM
Complete: 🔍

Comments are closed.