CVE-2019-20392 is an invalid memory access flaw in libyang versions prior to v1.0-r1, specifically within the resolve_feature_value() function. This vulnerability affects applications using libyang to parse untrusted YANG files, potentially leading to a crash if an undefined feature is referenced within a list key node's if-feature statement. Rated 6.5 MEDIUM, it has a low attack complexity and requires no privileges, but does necessitate user interaction (parsing a malicious file) to achieve a high impact on availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.11CPE matchmatch criteria | cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:* | ||
0.11CPE matchmatch criteria | cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:* | ||
0.12CPE matchmatch criteria | cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:* | ||
0.12CPE matchmatch criteria | cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:* | ||
0.13CPE matchmatch criteria | cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.