rpm package
opensuse/frr&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/frr&distro=openSUSE%20Tumbleweed
Vulnerabilities (35)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-46752 | Med | 5.9 | < 8.4-7.1 | 8.4-7.1 | Oct 26, 2023 | An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash. | |
| CVE-2023-41909 | Hig | 7.5 | < 8.4-6.1 | 8.4-6.1 | Sep 5, 2023 | An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference. | |
| CVE-2023-38802 | Hig | 7.5 | < 8.4-5.1 | 8.4-5.1 | Aug 29, 2023 | FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation). | |
| CVE-2023-41360 | Cri | 9.1 | < 8.4-5.1 | 8.4-5.1 | Aug 29, 2023 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation. | |
| CVE-2023-41358 | Hig | 7.5 | < 8.4-5.1 | 8.4-5.1 | Aug 29, 2023 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero. | |
| CVE-2023-3748 | Low | 3.5 | < 8.4-5.1 | 8.4-5.1 | Jul 24, 2023 | A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV w | |
| CVE-2023-31490 | Hig | 7.5 | < 8.4-4.1 | 8.4-4.1 | May 9, 2023 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function. | |
| CVE-2023-31489 | Med | 5.5 | < 8.4-4.1 | 8.4-4.1 | May 9, 2023 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function. | |
| CVE-2022-37032 | Cri | 9.1 | < 8.1-5.1 | 8.1-5.1 | Sep 19, 2022 | An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c. | |
| CVE-2022-37035 | Hig | 8.1 | < 8.4-1.1 | 8.4-1.1 | Aug 2, 2022 | An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP p | |
| CVE-2022-26128 | Hig | 7.8 | < 8.1-3.1 | 8.1-3.1 | Mar 3, 2022 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c. | |
| CVE-2022-26127 | Hig | 7.8 | < 8.1-3.1 | 8.1-3.1 | Mar 3, 2022 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c. | |
| CVE-2022-26126 | Hig | 7.8 | < 8.1-3.1 | 8.1-3.1 | Mar 3, 2022 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c. | |
| CVE-2022-26125 | Hig | 7.8 | < 8.1-3.1 | 8.1-3.1 | Mar 3, 2022 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c. | |
| CVE-2020-12831 | Med | 5.3 | < 7.5.1-3.1 | 7.5.1-3.1 | May 13, 2020 | An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon. |
- affected < 8.4-7.1fixed 8.4-7.1
An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.
- affected < 8.4-6.1fixed 8.4-6.1
An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.
- affected < 8.4-5.1fixed 8.4-5.1
FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).
- affected < 8.4-5.1fixed 8.4-5.1
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.
- affected < 8.4-5.1fixed 8.4-5.1
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.
- affected < 8.4-5.1fixed 8.4-5.1
A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV w
- affected < 8.4-4.1fixed 8.4-4.1
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.
- affected < 8.4-4.1fixed 8.4-4.1
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function.
- affected < 8.1-5.1fixed 8.1-5.1
An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.
- affected < 8.4-1.1fixed 8.4-1.1
An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP p
- affected < 8.1-3.1fixed 8.1-3.1
A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c.
- affected < 8.1-3.1fixed 8.1-3.1
A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c.
- affected < 8.1-3.1fixed 8.1-3.1
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.
- affected < 8.1-3.1fixed 8.1-3.1
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.
- affected < 7.5.1-3.1fixed 7.5.1-3.1
An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.
Page 2 of 2