CVE:CVE-2019-20398
CNNVD:CNNVD-202001-1028
libyang是一款使用C语言编写的YANG数据建模语言解析器和工具包。
libyang 1.0-r1之前的版本的‘lys_extension_instances_free()’函数中存在资源管理错误漏洞。攻击者可利用该漏洞造成应用程序崩溃。
solution:Upgrade cesnet libyang to a higher version than 0.11:r1,0.11:r2,0.12:r1,0.12:r2,0.13:r1,0.13:r2,0.14:r1,0.15:r1,0.16:r1,0.16:r2,0.16:r3,1.0:r1,1.0:r2,and avoid the version 0.11:r1,0.11:r2,0.12:r1,0.12:r2,0.13:r1,0.13:r2,0.14:r1,0.15:r1,0.16:r1,0.16:r2,0.16:r3,1.0:r1,1.0:r2