libyang up to version 1 release 4 has a stack-based buffer overflow in function make_canonical() in parser.c, when dealing with "identityref" types with a name longer than 511 bytes. An application that uses libyang to validate untrusted YANG files could be vulnerable to this flaw, which could be used by an attacker to cause a denial of service or possibly gain code execution.
Acknowledgments: Name: Riccardo Schirone (Red Hat Product Security)
Upstream fix: https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6
An application that parses untrusted YANG files could be vulnerable to this flaw. To trigger this flaw, a YANG module should have a leaf with type "identityref" and a default value longer than 511 bytes, which would cause a stack-based buffer overflow in make_canonical(), due to the insecure use of strcpy/sprintf without any check.
Created libyang tracking bugs for this issue: Affects: fedora-all [bug 1780494]
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:4360 https://access.redhat.com/errata/RHSA-2019:4360
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-19334