Skip to content
OpenAdvisories
Medium ELSA-2023-6434 4 CVEs

Moderate: frr security and bug fix update (Oracle Linux 9)

Published Nov 11, 2023 · Updated Nov 11, 2023

Ecosystem: Oracle Linux

Summary

[8.3.1-11]
- Resolves: RHEL-2263 - bgpd: Do not explicitly print MAXTTL value for ebgp-multihop vty output

[8.3.1-10]
- Related: #2216912 - adding sys_admin to capabilities

[8.3.1-9]
- Resolves: #2215346 - frr policy does not allow the execution of /usr/sbin/ipsec

[8.3.1-8]
- Resolves: #2216912 - SELinux is preventing FRR-Zebra to access to network namespaces

[8.3.1-7]
- Resolves: #2168855 - BFD not working through VRF

[8.3.1-6]
- Resolves: #2184870 - Reachable assertion in peek_for_as4_capability function
- Resolves: #2196795 - denial of service by crafting a BGP OPEN message with an option of type 0xff
- Resolves: #2196796 - denial of service by crafting a BGP OPEN message with an option of type 0xff
- Resolves: #2196794 - out-of-bounds read exists in the BGP daemon of FRRouting

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 9 frr 0:8.3.1-11.el9_3
Oracle Linux · 9 frr-selinux 0:8.3.1-11.el9_3

Vulnerabilities 4

  • Medium 6.5
    CVE-2022-40302

    An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0…

    frr Debian
  • Unscored —
    CVE-2022-36440

    A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can mali…

    frr Debian
  • Unscored —
    CVE-2022-40318

    An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0…

    frr Debian
  • Unscored —
    CVE-2022-43681

    An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message …

    frr Debian