CVE-2019-20391

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-20391
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20391.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-20391
Downstream
Published
2020-01-22T22:15:10Z
Modified
2026-08-07T15:18:53Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

References

Affected packages

Git / github.com/cesnet/libyang

Affected ranges

Type
GIT
Repo
https://github.com/cesnet/libyang
Events
Introduced
14a95280b2bd77b5fd1d9b5f8af71b15679f1a8f
Last Affected
347246611b85e05d16f54faaa5697c4b2ee4b468
Fixed
bdb596ddc07596fa212f231135b87d0b9178f6f8
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:1.0:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:1.0:r2:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "0.11-r1"
        },
        {
            "last_affected":  "0.11-r1"
        },
        {
            "introduced":  "0.11-r2"
        },
        {
            "last_affected":  "0.11-r2"
        },
        {
            "introduced":  "0.12-r1"
        },
        {
            "last_affected":  "0.12-r1"
        },
        {
            "introduced":  "0.12-r2"
        },
        {
            "last_affected":  "0.12-r2"
        },
        {
            "introduced":  "0.13-r1"
        },
        {
            "last_affected":  "0.13-r1"
        },
        {
            "introduced":  "0.13-r2"
        },
        {
            "last_affected":  "0.13-r2"
        },
        {
            "introduced":  "0.14-r1"
        },
        {
            "last_affected":  "0.14-r1"
        },
        {
            "introduced":  "0.15-r1"
        },
        {
            "last_affected":  "0.15-r1"
        },
        {
            "introduced":  "0.16-r1"
        },
        {
            "last_affected":  "0.16-r1"
        },
        {
            "introduced":  "0.16-r2"
        },
        {
            "last_affected":  "0.16-r2"
        },
        {
            "introduced":  "0.16-r3"
        },
        {
            "last_affected":  "0.16-r3"
        },
        {
            "introduced":  "1.0-r1"
        },
        {
            "last_affected":  "1.0-r1"
        },
        {
            "introduced":  "1.0-r2"
        },
        {
            "last_affected":  "1.0-r2"
        }
    ],
    "source":  [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.11-r1
0.11-r2
0.12-r1
0.12-r2
0.13-r1
0.13-r2
0.14-r1
0.15-r1
0.16-r1
0.16-r2
0.16-r3
1.*
1.0-r1
1.0-r2
v0.*
v0.11-r1
v0.11-r2
v0.12-r1
v0.12-r2
v0.13-r2
v0.14-r1
v0.15-r1
v0.16-r1
v0.16-r2
v1.*
v1.0-r1
v1.0-r2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20391.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "155430779242861446466177299443060400718",
                "15933832550298970296093717907452545562",
                "210533867413985869976612204320521306275",
                "217119053337116050957207098743507905420"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2019-20391-16593093",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/cesnet/libyang/commit/bdb596ddc07596fa212f231135b87d0b9178f6f8",
        "target":  {
            "file":  "src/resolve.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "144887731380011650420799519691260820041",
            "length":  143
        },
        "id":  "CVE-2019-20391-9d460c02",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/cesnet/libyang/commit/bdb596ddc07596fa212f231135b87d0b9178f6f8",
        "target":  {
            "file":  "src/resolve.c",
            "function":  "resolve_iffeature"
        }
    }
]
vanir_signatures_modified 
"2026-08-07T15:18:53Z"