Lucene search

DebianDEBIAN:DLA-3572-1:1B84E

HistorySep 19, 2023 - 7:37 p.m.

[SECURITY] [DLA 3572-1] libyang security update

2023-09-1919:37:43

lists.debian.org

libyang

parser toolkit

ietf yang

cve-2019-20391

debian 10

buster

security tracker

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

79.2%

JSON

Debian LTS Advisory DLA-3572-1 [email protected]
https://www.debian.org/lts/security/ Markus Koschany
September 19, 2023 https://wiki.debian.org/LTS

Package : libyang
Version : 0.16.105+really1.0-0+deb10u1
CVE ID : CVE-2019-20391 CVE-2019-20392 CVE-2019-20393 CVE-2019-20394
CVE-2019-20395 CVE-2019-20396 CVE-2019-20397 CVE-2019-20398

Multiple flaws were found in libyang, a parser toolkit for IETF YANG data
modeling. Double frees, invalid memory access and Null pointer dereferences
may cause a denial of service or potentially code execution.

For Debian 10 buster, these problems have been fixed in version
0.16.105+really1.0-0+deb10u1.

We recommend that you upgrade your libyang packages.

For the detailed security status of libyang please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libyang

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10alllibyang-cpp0.16< 0.16.105+really1.0-0+deb10u1libyang-cpp0.16_0.16.105+really1.0-0+deb10u1_all.deb
Debian10alllibyang-cpp1< 0.16.105+really1.0-0+deb10u1libyang-cpp1_0.16.105+really1.0-0+deb10u1_all.deb
Debian10alllibyang< 0.16.105+really1.0-0+deb10u1libyang_0.16.105+really1.0-0+deb10u1_all.deb
Debian10alllibyang-tools< 0.16.105+really1.0-0+deb10u1libyang-tools_0.16.105+really1.0-0+deb10u1_all.deb
Debian10allyang-tools< 0.16.105+really1.0-0+deb10u1yang-tools_0.16.105+really1.0-0+deb10u1_all.deb
Debian10alllibyang0.16< 0.16.105+really1.0-0+deb10u1libyang0.16_0.16.105+really1.0-0+deb10u1_all.deb
Debian10alllibyang1< 0.16.105+really1.0-0+deb10u1libyang1_0.16.105+really1.0-0+deb10u1_all.deb
Debian10alllibyang-cpp-dev< 0.16.105+really1.0-0+deb10u1libyang-cpp-dev_0.16.105+really1.0-0+deb10u1_all.deb
Debian10alllibyang-dev< 0.16.105+really1.0-0+deb10u1libyang-dev_0.16.105+really1.0-0+deb10u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	libyang-cpp0.16	< 0.16.105+really1.0-0+deb10u1	libyang-cpp0.16_0.16.105+really1.0-0+deb10u1_all.deb
Debian	10	all	libyang-cpp1	< 0.16.105+really1.0-0+deb10u1	libyang-cpp1_0.16.105+really1.0-0+deb10u1_all.deb
Debian	10	all	libyang	< 0.16.105+really1.0-0+deb10u1	libyang_0.16.105+really1.0-0+deb10u1_all.deb
Debian	10	all	libyang-tools	< 0.16.105+really1.0-0+deb10u1	libyang-tools_0.16.105+really1.0-0+deb10u1_all.deb
Debian	10	all	yang-tools	< 0.16.105+really1.0-0+deb10u1	yang-tools_0.16.105+really1.0-0+deb10u1_all.deb
Debian	10	all	libyang0.16	< 0.16.105+really1.0-0+deb10u1	libyang0.16_0.16.105+really1.0-0+deb10u1_all.deb
Debian	10	all	libyang1	< 0.16.105+really1.0-0+deb10u1	libyang1_0.16.105+really1.0-0+deb10u1_all.deb
Debian	10	all	libyang-cpp-dev	< 0.16.105+really1.0-0+deb10u1	libyang-cpp-dev_0.16.105+really1.0-0+deb10u1_all.deb
Debian	10	all	libyang-dev	< 0.16.105+really1.0-0+deb10u1	libyang-dev_0.16.105+really1.0-0+deb10u1_all.deb