Vulnerability-Lookup

CVE-2019-20396 (GCVE-0-2019-20396)

Vulnerability from cvelistv5 – Published: 2020-01-22 00:00 – Updated: 2024-08-05 02:39

Summary

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

Assigner

mitre mitre root

References

4 references

URL	Tags
https://github.com/CESNET/libyang/compare/v0.16-r…
https://github.com/CESNET/libyang/issues/740
https://github.com/CESNET/libyang/commit/a1f17693…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T02:39:09.540Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/CESNET/libyang/issues/740"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8"
          },
          {
            "name": "[debian-lts-announce] 20230919 [SECURITY] [DLA 3572-1] libyang security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-19T21:06:21.418Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1"
        },
        {
          "url": "https://github.com/CESNET/libyang/issues/740"
        },
        {
          "url": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8"
        },
        {
          "name": "[debian-lts-announce] 20230919 [SECURITY] [DLA 3572-1] libyang security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-20396",
    "datePublished": "2020-01-22T00:00:00.000Z",
    "dateReserved": "2020-01-22T00:00:00.000Z",
    "dateUpdated": "2024-08-05T02:39:09.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2019-20396",
      "date": "2026-09-15",
      "epss": "0.01914",
      "percentile": "0.7872"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*\", \"matchCriteriaId\": \"65E91322-5F67-43C2-8112-5ECAEC2A3C12\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*\", \"matchCriteriaId\": \"80A88DE4-93F8-40C3-AA52-A5F353F028AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*\", \"matchCriteriaId\": \"05C120CA-50EF-4B6D-92C9-ED736219DB07\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*\", \"matchCriteriaId\": \"99D1FA55-3F56-4E09-B41E-B05C199B96B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*\", \"matchCriteriaId\": \"35D48EC4-58D2-49C6-8049-920787733587\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*\", \"matchCriteriaId\": \"B57F3953-49D6-413C-A4AE-03125935FC77\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD62411F-A524-4E80-B540-780EA39CB6A4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FEF091B1-978A-4881-B1FC-6848CD1A7BBF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C50D690-9A4D-4B78-BF4E-A4D9B4074216\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*\", \"matchCriteriaId\": \"124A5D30-7451-4516-9AA2-963AE62DD679\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*\", \"matchCriteriaId\": \"C260D13B-82E9-4596-9116-61073B42D661\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.\"}, {\"lang\": \"es\", \"value\": \"Un error de segmentaci\\u00f3n est\\u00e1 presente en yyparse en libyang versiones anteriores a v1.0-r1, debido a un valor de sentencia pattern malformado durante el an\\u00e1lisis de lys_parse_path.\"}]",
      "id": "CVE-2019-20396",
      "lastModified": "2024-11-21T04:38:23.180",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:N/A:P\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2020-01-22T22:15:10.470",
      "references": "[{\"url\": \"https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/CESNET/libyang/issues/740\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/CESNET/libyang/issues/740\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-119\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-20396\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-01-22T22:15:10.470\",\"lastModified\":\"2024-11-21T04:38:23.180\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.\"},{\"lang\":\"es\",\"value\":\"Un error de segmentaci\u00f3n est\u00e1 presente en yyparse en libyang versiones anteriores a v1.0-r1, debido a un valor de sentencia pattern malformado durante el an\u00e1lisis de lys_parse_path.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"65E91322-5F67-43C2-8112-5ECAEC2A3C12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"80A88DE4-93F8-40C3-AA52-A5F353F028AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"05C120CA-50EF-4B6D-92C9-ED736219DB07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"99D1FA55-3F56-4E09-B41E-B05C199B96B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"35D48EC4-58D2-49C6-8049-920787733587\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B57F3953-49D6-413C-A4AE-03125935FC77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD62411F-A524-4E80-B540-780EA39CB6A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FEF091B1-978A-4881-B1FC-6848CD1A7BBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C50D690-9A4D-4B78-BF4E-A4D9B4074216\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"124A5D30-7451-4516-9AA2-963AE62DD679\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C260D13B-82E9-4596-9116-61073B42D661\"}]}]}],\"references\":[{\"url\":\"https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/CESNET/libyang/issues/740\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/CESNET/libyang/issues/740\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T16:07:03+00:00",
      "cve": "CVE-2019-20396",
      "id": "CVE-2019-20396",
      "initial_release_date": "2019-03-29T00:00:00+00:00",
      "product_status:fixed": "26",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libyang: heap-based buffer over-read in function lys_type_free() due to malformed pattern",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-20396.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-04-14T08:56:49Z",
      "cve": "CVE-2019-20396",
      "id": "CVE-2019-20396",
      "initial_release_date": "2026-04-14T08:56:49Z",
      "product_status:recommended": "1",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2019-20396",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2019-20396.json",
      "version": "2"
    }
  }
}

CNVD-2020-10247

Vulnerability from cnvd - Published: 2020-02-19

Title

libyang输入验证错误漏洞

Description

libyang是一款使用C语言编写的YANG数据建模语言解析器和工具包。 libyang v1.0-r1之前版本中的yyparse存在输入验证错误漏洞。该漏洞源于网络系统或产品未对输入的数据进行正确的验证。目前没有详细漏洞细节提供。

Severity

中

Patch Name

libyang输入验证错误漏洞的补丁

Patch Description

libyang是一款使用C语言编写的YANG数据建模语言解析器和工具包。 libyang v1.0-r1之前版本中的yyparse存在输入验证错误漏洞。该漏洞源于网络系统或产品未对输入的数据进行正确的验证。目前没有详细漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8

Reference

https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8

Impacted products

Name
libyang libyang <v1.0-r1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-20396",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-20396"
    }
  },
  "description": "libyang\u662f\u4e00\u6b3e\u4f7f\u7528C\u8bed\u8a00\u7f16\u5199\u7684YANG\u6570\u636e\u5efa\u6a21\u8bed\u8a00\u89e3\u6790\u5668\u548c\u5de5\u5177\u5305\u3002\n\nlibyang v1.0-r1\u4e4b\u524d\u7248\u672c\u4e2d\u7684yyparse\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u5bf9\u8f93\u5165\u7684\u6570\u636e\u8fdb\u884c\u6b63\u786e\u7684\u9a8c\u8bc1\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-10247",
  "openTime": "2020-02-19",
  "patchDescription": "libyang\u662f\u4e00\u6b3e\u4f7f\u7528C\u8bed\u8a00\u7f16\u5199\u7684YANG\u6570\u636e\u5efa\u6a21\u8bed\u8a00\u89e3\u6790\u5668\u548c\u5de5\u5177\u5305\u3002\r\n\r\nlibyang v1.0-r1\u4e4b\u524d\u7248\u672c\u4e2d\u7684yyparse\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u5bf9\u8f93\u5165\u7684\u6570\u636e\u8fdb\u884c\u6b63\u786e\u7684\u9a8c\u8bc1\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "libyang\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "libyang libyang \u003cv1.0-r1"
  },
  "referenceLink": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8",
  "serverity": "\u4e2d",
  "submitTime": "2020-02-18",
  "title": "libyang\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}

FKIE_CVE-2019-20396

Vulnerability from fkie_nvd - Published: 2020-01-22 22:15 - Updated: 2026-06-17 02:30

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

References

URL	Tags
cve@mitre.org	https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8	Patch, Third Party Advisory
cve@mitre.org	https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1	Third Party Advisory
cve@mitre.org	https://github.com/CESNET/libyang/issues/740	Exploit, Third Party Advisory
cve@mitre.org	https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
af854a3a-2127-422b-91ae-364da2661108	https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/CESNET/libyang/issues/740	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html

Impacted products

Vendor	Product	Version
cesnet	libyang	0.11
cesnet	libyang	0.11
cesnet	libyang	0.12
cesnet	libyang	0.12
cesnet	libyang	0.13
cesnet	libyang	0.13
cesnet	libyang	0.14
cesnet	libyang	0.15
cesnet	libyang	0.16
cesnet	libyang	0.16
cesnet	libyang	0.16

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*",
              "matchCriteriaId": "65E91322-5F67-43C2-8112-5ECAEC2A3C12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*",
              "matchCriteriaId": "80A88DE4-93F8-40C3-AA52-A5F353F028AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*",
              "matchCriteriaId": "05C120CA-50EF-4B6D-92C9-ED736219DB07",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*",
              "matchCriteriaId": "99D1FA55-3F56-4E09-B41E-B05C199B96B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*",
              "matchCriteriaId": "35D48EC4-58D2-49C6-8049-920787733587",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*",
              "matchCriteriaId": "B57F3953-49D6-413C-A4AE-03125935FC77",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*",
              "matchCriteriaId": "DD62411F-A524-4E80-B540-780EA39CB6A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*",
              "matchCriteriaId": "FEF091B1-978A-4881-B1FC-6848CD1A7BBF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*",
              "matchCriteriaId": "0C50D690-9A4D-4B78-BF4E-A4D9B4074216",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*",
              "matchCriteriaId": "124A5D30-7451-4516-9AA2-963AE62DD679",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*",
              "matchCriteriaId": "C260D13B-82E9-4596-9116-61073B42D661",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing."
    },
    {
      "lang": "es",
      "value": "Un error de segmentaci\u00f3n est\u00e1 presente en yyparse en libyang versiones anteriores a v1.0-r1, debido a un valor de sentencia pattern malformado durante el an\u00e1lisis de lys_parse_path."
    }
  ],
  "id": "CVE-2019-20396",
  "lastModified": "2026-06-17T02:30:21.600",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-01-22T22:15:10.470",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/libyang/issues/740"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/libyang/issues/740"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-8WPF-H467-QVV5

Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2023-09-20 00:30

Details

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-20396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-22T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.",
  "id": "GHSA-8wpf-h467-qvv5",
  "modified": "2023-09-20T00:30:15Z",
  "published": "2022-05-24T17:07:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20396"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CESNET/libyang/issues/740"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2019-20396

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Aliases

CVE-2019-20396

Aliases

CVE-2019-20396

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2019-20396",
    "description": "A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.",
    "id": "GSD-2019-20396",
    "references": [
      "https://access.redhat.com/errata/RHEA-2021:1906"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-20396"
      ],
      "details": "A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.",
      "id": "GSD-2019-20396",
      "modified": "2023-12-13T01:23:42.789083Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2019-20396",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1",
            "refsource": "MISC",
            "url": "https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1"
          },
          {
            "name": "https://github.com/CESNET/libyang/issues/740",
            "refsource": "MISC",
            "url": "https://github.com/CESNET/libyang/issues/740"
          },
          {
            "name": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8",
            "refsource": "MISC",
            "url": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8"
          },
          {
            "name": "[debian-lts-announce] 20230919 [SECURITY] [DLA 3572-1] libyang security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-20396"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1"
            },
            {
              "name": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8"
            },
            {
              "name": "https://github.com/CESNET/libyang/issues/740",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/CESNET/libyang/issues/740"
            },
            {
              "name": "[debian-lts-announce] 20230919 [SECURITY] [DLA 3572-1] libyang security update",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-09-19T22:15Z",
      "publishedDate": "2020-01-22T22:15Z"
    }
  }
}

RHEA-2021:1906

Vulnerability from csaf_redhat - Published: 2021-05-18 15:04 - Updated: 2025-11-21 17:24

Summary

Red Hat Enhancement Advisory: libyang bug fix and enhancement update

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2019-20396.

CVE-2019-20396

A heap-based buffer over-read flaw occurs in libyang in function lys_type_free() due to a malformed pattern statement value. Applications that use libyang to process untrusted input yang files may be vulnerable to this flaw, possibly causing a crash or information leaks.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Fixed: 26 products

https://access.redhat.com/errata/RHEA-2021:1906

Open the full advisory

RHEA-2021_1906

Vulnerability from csaf_redhat - Published: 2021-05-18 15:04 - Updated: 2024-11-22 16:19

Summary

Red Hat Enhancement Advisory: libyang bug fix and enhancement update

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2019-20396.

CVE-2019-20396

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Fixed: 26 products

https://access.redhat.com/errata/RHEA-2021:1906

Open the full advisory

ubuntu-cve-2019-20396

Vulnerability from osv_ubuntu

Published

2020-01-22 22:15

Modified

2026-04-22 07:39

Summary

Details

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2019-20396	REPORT
	https://github.com/CESNET/libyang/commit/a1f17693…	REPORT
	https://github.com/CESNET/libyang/issues/740	REPORT
	https://github.com/CESNET/libyang/compare/v0.16-r…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2019-20396	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libyang-cpp0.16",
            "binary_version": "0.16.105-3build1"
          },
          {
            "binary_name": "libyang0.16",
            "binary_version": "0.16.105-3build1"
          },
          {
            "binary_name": "python3-yang",
            "binary_version": "0.16.105-3build1"
          },
          {
            "binary_name": "yang-tools",
            "binary_version": "0.16.105-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libyang",
        "purl": "pkg:deb/ubuntu/libyang@0.16.105-3build1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.16.105-1",
        "0.16.105-2",
        "0.16.105-3",
        "0.16.105-3build1"
      ]
    }
  ],
  "aliases": [],
  "details": "A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.",
  "id": "UBUNTU-CVE-2019-20396",
  "modified": "2026-04-22T07:39:14Z",
  "published": "2020-01-22T22:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-20396"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/CESNET/libyang/issues/740"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-20396"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2019-20396"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2019-20396 (GCVE-0-2019-20396)

CNVD-2020-10247

FKIE_CVE-2019-20396

GHSA-8WPF-H467-QVV5

GSD-2019-20396

RHEA-2021:1906

RHEA-2021_1906

ubuntu-cve-2019-20396

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour