rpm package
suse/frr&distro=SUSE Linux Enterprise Module for Server Applications 15 SP5
pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP5
Vulnerabilities (19)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-44070 | — | < 8.4-150500.4.26.1 | 8.4-150500.4.26.1 | Aug 19, 2024 | An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value. | ||
| CVE-2024-34088 | — | < 8.4-150500.4.23.1 | 8.4-150500.4.23.1 | Apr 30, 2024 | In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling functions do not handle the returned NULL value, the OSPF daemon crashes, leading to denial of service. | ||
| CVE-2024-31951 | — | < 8.4-150500.4.23.1 | 8.4-150500.4.23.1 | Apr 7, 2024 | In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated). | ||
| CVE-2024-31950 | — | < 8.4-150500.4.23.1 | 8.4-150500.4.23.1 | Apr 7, 2024 | In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt to read Segment Routing subTLVs (their size is not validated). | ||
| CVE-2024-31948 | — | < 8.4-150500.4.20.1 | 8.4-150500.4.20.1 | Apr 7, 2024 | In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash. | ||
| CVE-2024-27913 | — | < 8.4-150500.4.20.1 | 8.4-150500.4.20.1 | Feb 28, 2024 | ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted access to a missing attribute field. | ||
| CVE-2023-38407 | — | < 8.4-150500.4.15.1 | 8.4-150500.4.15.1 | Nov 6, 2023 | bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing. | ||
| CVE-2023-38406 | — | < 8.4-150500.4.15.1 | 8.4-150500.4.15.1 | Nov 6, 2023 | bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow." | ||
| CVE-2023-47235 | — | < 8.4-150500.4.15.1 | 8.4-150500.4.15.1 | Nov 3, 2023 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome. | ||
| CVE-2023-47234 | — | < 8.4-150500.4.15.1 | 8.4-150500.4.15.1 | Nov 3, 2023 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes). | ||
| CVE-2023-46753 | — | < 8.4-150500.4.11.1 | 8.4-150500.4.11.1 | Oct 26, 2023 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute. | ||
| CVE-2023-46752 | — | < 8.4-150500.4.11.1 | 8.4-150500.4.11.1 | Oct 26, 2023 | An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash. | ||
| CVE-2023-41909 | — | < 8.4-150500.4.8.1 | 8.4-150500.4.8.1 | Sep 5, 2023 | An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference. | ||
| CVE-2023-41360 | — | < 8.4-150500.4.8.1 | 8.4-150500.4.8.1 | Aug 29, 2023 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation. | ||
| CVE-2023-41358 | — | < 8.4-150500.4.8.1 | 8.4-150500.4.8.1 | Aug 29, 2023 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero. | ||
| CVE-2023-38802 | — | < 8.4-150500.4.8.1 | 8.4-150500.4.8.1 | Aug 29, 2023 | FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation). | ||
| CVE-2023-3748 | — | < 8.4-150500.4.8.1 | 8.4-150500.4.8.1 | Jul 24, 2023 | A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV w | ||
| CVE-2023-31490 | — | < 8.4-150500.4.3.1 | 8.4-150500.4.3.1 | May 9, 2023 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function. | ||
| CVE-2023-31489 | — | < 8.4-150500.4.3.1 | 8.4-150500.4.3.1 | May 9, 2023 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function. |
- CVE-2024-44070Aug 19, 2024affected < 8.4-150500.4.26.1fixed 8.4-150500.4.26.1
An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value.
- CVE-2024-34088Apr 30, 2024affected < 8.4-150500.4.23.1fixed 8.4-150500.4.23.1
In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling functions do not handle the returned NULL value, the OSPF daemon crashes, leading to denial of service.
- CVE-2024-31951Apr 7, 2024affected < 8.4-150500.4.23.1fixed 8.4-150500.4.23.1
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
- CVE-2024-31950Apr 7, 2024affected < 8.4-150500.4.23.1fixed 8.4-150500.4.23.1
In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt to read Segment Routing subTLVs (their size is not validated).
- CVE-2024-31948Apr 7, 2024affected < 8.4-150500.4.20.1fixed 8.4-150500.4.20.1
In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.
- CVE-2024-27913Feb 28, 2024affected < 8.4-150500.4.20.1fixed 8.4-150500.4.20.1
ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted access to a missing attribute field.
- CVE-2023-38407Nov 6, 2023affected < 8.4-150500.4.15.1fixed 8.4-150500.4.15.1
bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.
- CVE-2023-38406Nov 6, 2023affected < 8.4-150500.4.15.1fixed 8.4-150500.4.15.1
bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."
- CVE-2023-47235Nov 3, 2023affected < 8.4-150500.4.15.1fixed 8.4-150500.4.15.1
An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome.
- CVE-2023-47234Nov 3, 2023affected < 8.4-150500.4.15.1fixed 8.4-150500.4.15.1
An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes).
- CVE-2023-46753Oct 26, 2023affected < 8.4-150500.4.11.1fixed 8.4-150500.4.11.1
An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.
- CVE-2023-46752Oct 26, 2023affected < 8.4-150500.4.11.1fixed 8.4-150500.4.11.1
An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.
- CVE-2023-41909Sep 5, 2023affected < 8.4-150500.4.8.1fixed 8.4-150500.4.8.1
An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.
- CVE-2023-41360Aug 29, 2023affected < 8.4-150500.4.8.1fixed 8.4-150500.4.8.1
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.
- CVE-2023-41358Aug 29, 2023affected < 8.4-150500.4.8.1fixed 8.4-150500.4.8.1
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.
- CVE-2023-38802Aug 29, 2023affected < 8.4-150500.4.8.1fixed 8.4-150500.4.8.1
FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).
- CVE-2023-3748Jul 24, 2023affected < 8.4-150500.4.8.1fixed 8.4-150500.4.8.1
A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV w
- CVE-2023-31490May 9, 2023affected < 8.4-150500.4.3.1fixed 8.4-150500.4.3.1
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.
- CVE-2023-31489May 9, 2023affected < 8.4-150500.4.3.1fixed 8.4-150500.4.3.1
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function.