This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-28902 →

DEBIAN-CVE-2021-28902

In function read_yin_container() in libyang

Original description

The description as published by the source.

In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:13 libyang

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2+dfsg-2"}]}]

Debian:14 libyang

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2+dfsg-2"}]}]

References

advisory security-tracker.debian.org