rpm package
almalinux/frr-selinux
pkg:rpm/almalinux/frr-selinux
Vulnerabilities (18)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-38407 | — | < 7.5.1-13.el8_9.3.alma.1 | 7.5.1-13.el8_9.3.alma.1 | Nov 6, 2023 | bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing. | ||
| CVE-2023-38406 | — | < 7.5.1-13.el8_9.3.alma.1 | 7.5.1-13.el8_9.3.alma.1 | Nov 6, 2023 | bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow." | ||
| CVE-2023-47235 | — | < 7.5.1-13.el8_9.3.alma.1 | 7.5.1-13.el8_9.3.alma.1 | Nov 3, 2023 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome. | ||
| CVE-2023-47234 | — | < 7.5.1-13.el8_9.3.alma.1 | 7.5.1-13.el8_9.3.alma.1 | Nov 3, 2023 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes). | ||
| CVE-2023-46753 | — | < 8.5.3-4.el9 | 8.5.3-4.el9 | Oct 26, 2023 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute. | ||
| CVE-2023-46752 | — | < 8.5.3-4.el9 | 8.5.3-4.el9 | Oct 26, 2023 | An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash. | ||
| CVE-2023-41909 | — | < 8.5.3-4.el9 | 8.5.3-4.el9 | Sep 5, 2023 | An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference. | ||
| CVE-2023-41360 | — | < 8.5.3-4.el9 | 8.5.3-4.el9 | Aug 29, 2023 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation. | ||
| CVE-2023-41359 | — | < 8.5.3-4.el9 | 8.5.3-4.el9 | Aug 29, 2023 | An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during AIGP validation. | ||
| CVE-2023-41358 | — | < 8.5.3-4.el9 | 8.5.3-4.el9 | Aug 29, 2023 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero. | ||
| CVE-2023-38802 | — | < 8.3.1-5.el9_2.2.alma | 8.3.1-5.el9_2.2.alma | Aug 29, 2023 | FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation). | ||
| CVE-2023-31490 | — | < 8.5.3-4.el9 | 8.5.3-4.el9 | May 9, 2023 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function. | ||
| CVE-2023-31489 | — | < 8.5.3-4.el9 | 8.5.3-4.el9 | May 9, 2023 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function. | ||
| CVE-2022-43681 | — | < 8.3.1-11.el9_3.alma.1 | 8.3.1-11.el9_3.alma.1 | May 3, 2023 | An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, t | ||
| CVE-2022-40318 | — | < 8.3.1-11.el9_3.alma.1 | 8.3.1-11.el9_3.alma.1 | May 3, 2023 | An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible beca | ||
| CVE-2022-40302 | — | < 8.3.1-11.el9_3.alma.1 | 8.3.1-11.el9_3.alma.1 | May 3, 2023 | An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible beca | ||
| CVE-2022-36440 | — | < 8.3.1-11.el9_3.alma.1 | 8.3.1-11.el9_3.alma.1 | Apr 3, 2023 | A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS. | ||
| CVE-2022-37032 | — | < 8.3.1-5.el9 | 8.3.1-5.el9 | Sep 19, 2022 | An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c. |
- CVE-2023-38407Nov 6, 2023affected < 7.5.1-13.el8_9.3.alma.1fixed 7.5.1-13.el8_9.3.alma.1
bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.
- CVE-2023-38406Nov 6, 2023affected < 7.5.1-13.el8_9.3.alma.1fixed 7.5.1-13.el8_9.3.alma.1
bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."
- CVE-2023-47235Nov 3, 2023affected < 7.5.1-13.el8_9.3.alma.1fixed 7.5.1-13.el8_9.3.alma.1
An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome.
- CVE-2023-47234Nov 3, 2023affected < 7.5.1-13.el8_9.3.alma.1fixed 7.5.1-13.el8_9.3.alma.1
An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes).
- CVE-2023-46753Oct 26, 2023affected < 8.5.3-4.el9fixed 8.5.3-4.el9
An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.
- CVE-2023-46752Oct 26, 2023affected < 8.5.3-4.el9fixed 8.5.3-4.el9
An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.
- CVE-2023-41909Sep 5, 2023affected < 8.5.3-4.el9fixed 8.5.3-4.el9
An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.
- CVE-2023-41360Aug 29, 2023affected < 8.5.3-4.el9fixed 8.5.3-4.el9
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.
- CVE-2023-41359Aug 29, 2023affected < 8.5.3-4.el9fixed 8.5.3-4.el9
An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during AIGP validation.
- CVE-2023-41358Aug 29, 2023affected < 8.5.3-4.el9fixed 8.5.3-4.el9
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.
- CVE-2023-38802Aug 29, 2023affected < 8.3.1-5.el9_2.2.almafixed 8.3.1-5.el9_2.2.alma
FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).
- CVE-2023-31490May 9, 2023affected < 8.5.3-4.el9fixed 8.5.3-4.el9
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.
- CVE-2023-31489May 9, 2023affected < 8.5.3-4.el9fixed 8.5.3-4.el9
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function.
- CVE-2022-43681May 3, 2023affected < 8.3.1-11.el9_3.alma.1fixed 8.3.1-11.el9_3.alma.1
An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, t
- CVE-2022-40318May 3, 2023affected < 8.3.1-11.el9_3.alma.1fixed 8.3.1-11.el9_3.alma.1
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible beca
- CVE-2022-40302May 3, 2023affected < 8.3.1-11.el9_3.alma.1fixed 8.3.1-11.el9_3.alma.1
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible beca
- CVE-2022-36440Apr 3, 2023affected < 8.3.1-11.el9_3.alma.1fixed 8.3.1-11.el9_3.alma.1
A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS.
- CVE-2022-37032Sep 19, 2022affected < 8.3.1-5.el9fixed 8.3.1-5.el9
An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.