CVE:CVE-2019-19334
CNNVD:CNNVD-201912-262
libyang是一款使用C语言编写的YANG数据建模语言解析器和工具包。
libyang 1.0-r5之前版本中存在缓冲区错误漏洞。攻击者可借助不可信的YANG文件利用该漏洞导致拒绝服务或执行代码。
solution:Upgrade cesnet libyang to a higher version than 0.11:r1,0.11:r2,0.12:r1,0.12:r2,0.13:r1,0.13:r2,0.14:r1,0.15:r1,0.16:r1,0.16:r2,0.16:r3,1.0:r1,1.0:r2,1.0:r3,1.0:r4,and avoid the version 0.11:r1,0.11:r2,0.12:r1,0.12:r2,0.13:r1,0.13:r2,0.14:r1,0.15:r1,0.16:r1,0.16:r2,0.16:r3,1.0:r1,1.0:r2,1.0:r3,1.0:r4; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade fedoraproject fedora to a higher version than 31,and avoid the version 31