Red Hat Security Advisory: frr security update

Fixed packages 4

Vulnerabilities 4

• High 7.5
  CVE-2023-38407

  bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast par…

  frr frr Debian Ubuntu
  Nov 6, 2023
• High 7.5
  CVE-2023-47234

  An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message …

  frr frr frr Debian Ubuntu Azure Linux
  Nov 3, 2023
• Medium 6.8
  CVE-2023-47235

  An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an E…

  frr frr frr Debian Ubuntu Azure Linux
  Nov 3, 2023
• Unscored —
  CVE-2023-38406

  bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."

  frr frr Debian Ubuntu
  Nov 6, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2248207
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2248208
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2248526
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2248528
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0130.json
• report
  https://access.redhat.com/security/cve/CVE-2023-38406
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-38406
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-38406
• article
  https://github.com/FRRouting/frr/pull/12884
• report
  https://access.redhat.com/security/cve/CVE-2023-38407
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-38407
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-38407
• article
  https://github.com/FRRouting/frr/pull/12951
• article
  https://github.com/FRRouting/frr/pull/12956
• report
  https://access.redhat.com/security/cve/CVE-2023-47234
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-47234
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-47234
• report
  https://access.redhat.com/security/cve/CVE-2023-47235
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-47235
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-47235