Unrated severityNVD Advisory· Published Jan 22, 2020· Updated Aug 5, 2024

CVE-2019-20398

Description

A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

libyang/libyangdescription
libyang/libyangllm-fuzzy
Range: < v1.0-r3

Patches

Vulnerability mechanics

References

lists.debian.org/debian-lts-announce/2023/09/msg00019.htmlmitremailing-list
bugzilla.redhat.com/show_bug.cgimitre
github.com/CESNET/libyang/commit/7852b272ef77f8098c35deea6c6f09cb78176f08mitre
github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3mitre
github.com/CESNET/libyang/issues/773mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000