In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a crash.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is     NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a     crash. (CVE-2021-28904)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of
    retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of
    retval->ext[r]->flags that results in a crash. (CVE-2021-28902)

  - A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem().
    lyxml_parse_elem() function will be called recursively, which will consume stack space and lead to crash.
    (CVE-2021-28903)

  - In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is
    NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a
    crash. (CVE-2021-28904)

  - In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be
    NULL. But in some cases, node->module can be null, which triggers a reachable assertion (CWE-617).
    (CVE-2021-28905)

  - In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r]
    is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results
    in a crash. (CVE-2021-28906)

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3245-1 advisory.

    - CVE-2021-28906: Fixed missing check in read_yin_leaf that can lead to DoS (bsc#1186378)
    - CVE-2021-28904: Fixed missing check in ext_get_plugin that lead to DoS (bsc#1186376).
    - CVE-2021-28903: Fixed stack overflow in lyxml_parse_mem (bsc#1186375).
    - CVE-2021-28902: Fixed missing check in read_yin_container that can lead to DoS (bsc#1186374).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-54 (libyang: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libyang. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
223695	Linux Distros Unpatched Vulnerability : CVE-2021-28904	Nessus	Misc.	high
405454	Alpine: multiple libyang packages: security update to 1.0.215-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405454	Alpine: multiple libyang packages: security update to 1.0.215-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405453	Alpine: multiple libyang packages: security update to 1.0.184-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405453	Alpine: multiple libyang packages: security update to 1.0.184-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400210	Alpine: multiple libyang packages: security update to 1.0.215-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400210	Alpine: multiple libyang packages: security update to 1.0.215-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
164976	SUSE SLES15: libyang-cpp-devel / libyang-cpp1 / libyang-devel / libyang-doc / etc (SUSE-SU-2022:3245-1)	Nessus	SuSE Local Security Checks	high
156981	GLSA-202107-54 : libyang: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2021-28904

high

Tenable Plugins

high

high

high

high

high

high

high

high

high