Alpine: multiple libyang packages: security update to 1.0.215-r0 (deprecated)

high Tenable Self-Hosted Container Security Plugin ID 400210

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of
retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of
retval->ext[r]->flags that results in a crash. (CVE-2021-28902)

- A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem().
lyxml_parse_elem() function will be called recursively, which will consume stack space and lead to crash.
(CVE-2021-28903)

- In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is
NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a
crash. (CVE-2021-28904)

- In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be
NULL. But in some cases, node->module can be null, which triggers a reachable assertion (CWE-617).
(CVE-2021-28905)

- In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r]
is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results
in a crash. (CVE-2021-28906)

Plugin Details

Severity: High

ID: 400210

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.11

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2021-28906

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/31/2021

Vulnerability Publication Date: 5/20/2021

Reference Information

CVE: CVE-2021-28902, CVE-2021-28903, CVE-2021-28904, CVE-2021-28905, CVE-2021-28906

Detections

Analytics