Medium ELSA-2024-0477 4 CVEs

Moderate: frr security update (Oracle Linux 9)

Published Jan 26, 2024 · Updated Jan 26, 2024

Ecosystem: Oracle Linux

Summary

[8.3.1-11.2]
- Add patches for CVE-2023-47235, CVE-2023-47234, CVE-2023-38406, CVE-2023-38407

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 9	frr	0:8.3.1-11.el9_3.2
Oracle Linux · 9	frr-selinux	0:8.3.1-11.el9_3.2

Vulnerabilities 4

High 7.5

CVE-2023-38407

bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast par…

frr frr Debian Ubuntu

Nov 6, 2023
High 7.5

CVE-2023-47234

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message …

frr frr frr Debian Ubuntu Azure Linux

Nov 3, 2023
Medium 6.8

CVE-2023-47235

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an E…

frr frr frr Debian Ubuntu Azure Linux

Nov 3, 2023
Unscored —

CVE-2023-38406

bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."

frr frr Debian Ubuntu

Nov 6, 2023