PT-2023-20845 · Libyang+4 · Libyang+4

Thonsun · Published 2023-04-11 · Updated 2025-09-16 · CVE-2023-26917

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libyang versions 2.0.164 through 2.1.30

Description The issue is related to a NULL pointer dereference in the function lysp stmt validate value at lys parse mem.c. This problem can be triggered, potentially leading to unintended behavior or crashes. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For libyang versions 2.0.164 through 2.1.30, consider updating to a version that contains a fix for this issue, as no specific workaround or mitigation measures are provided in the given information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2023-1739

AZL-26153

CVE-2023-26917

USN-7752-1

Affected Products

Alt Linux

Debian

Linuxmint

Ubuntu

Libyang

References · 14

• 🔥 https://github.com/CESNET/libyang/issues/1987 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-26917 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-26917 · Security Note
• https://ubuntu.com/security/CVE-2023-26917 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26917 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7752-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26916 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7752-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-26153 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-26917 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26917 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26917 · Vendor Advisory
• https://t.me/cibsecurity/61855 · Telegram Post
• https://t.me/cvenotify/110859 · Telegram Post