Skip to content
OpenAdvisories
Medium ELSA-2024-2981 5 CVEs

Moderate: frr security update (Oracle Linux 8)

Published May 23, 2024 · Updated May 23, 2024

Summary

[7.5.1-22.0.1]
- Fix POSTIN scriptlet [Orabug: 34712485]
- Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgp_flowspec.c
- Resolves: RHEL-15919 - Out of bounds read in bgpd/bgp_label.c
- Resolves: RHEL-15869 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
- Resolves: RHEL-15868 - crash from malformed EOR-containing BGP UPDATE message

[7.5.1-22]
- Resolves: RHEL-22303 - Zebra not fetching host routes

[7.5.1-21]
- Resolves: RHEL-2216 - NULL pointer dereference

[7.5.1-20]
- Resolves: RHEL-4797 - missing length check in bgp_attr_psid_sub() can lead do DoS

[7.5.1-19]
- Resolves: RHEL-14824 - crafted BGP UPDATE message leading to a crash

[7.5.1-18]
- Resolves: RHEL-14821 - mishandled malformed data leading to a crash

[7.5.1-17]
- Resolves: RHEL-6583 - Routes are not refreshed after changing the inbound route rules from deny to permit

[7.5.1-16]
- Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgp_flowspec.c
- Resolves: RHEL-15919 - Out of bounds read in bgpd/bgp_label.c
- Resolves: RHEL-15869 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
- Resolves: RHEL-15868 - crash from malformed EOR-containing BGP UPDATE message

[7.5.1-15]
- Resolves: RHEL-12039 - crash in plist update

[7.5.1-14]
- Resolves: RHEL-6617 - Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 8 frr 0:7.5.1-22.0.1.el8
Oracle Linux · 8 frr-selinux 0:7.5.1-22.0.1.el8

Vulnerabilities 5