Red Hat Security Advisory: frr security update

Fixed packages 4

Vulnerabilities 8

• Critical 9.1
  CVE-2023-41360

  An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in …

  frr frr quagga frr Debian Ubuntu Azure Linux
  Aug 29, 2023
• Unscored —
  CVE-2023-31489

  An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_l…

  frr Debian
  May 9, 2023
• Unscored —
  CVE-2023-31490

  An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_su…

  frr frr frr Debian Ubuntu Azure Linux
  May 9, 2023
• Unscored —
  CVE-2023-41358

  An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.

  frr frr quagga frr Debian Ubuntu Azure Linux
  Aug 29, 2023
• Unscored —
  CVE-2023-41359

  An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp…

  frr Azure Linux
  Aug 29, 2023
• Unscored —
  CVE-2023-41909

  An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malforme…

  frr frr Debian Ubuntu
  Sep 5, 2023
• Unscored —
  CVE-2023-46752

  An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.

  frr frr frr Debian Ubuntu Azure Linux
  Oct 26, 2023
• Unscored —
  CVE-2023-46753

  An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mand…

  frr frr quagga frr Debian Ubuntu Azure Linux
  Oct 26, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2235839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2235840
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2235842
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237416
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2238990
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2238992
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246381
• article
  https://issues.redhat.com/browse/RHEL-11664
• article
  https://issues.redhat.com/browse/RHEL-15291
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2156.json
• report
  https://access.redhat.com/security/cve/CVE-2023-31489
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-31489
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-31489
• report
  https://access.redhat.com/security/cve/CVE-2023-31490
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-31490
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-31490
• report
  https://access.redhat.com/security/cve/CVE-2023-41358
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41358
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41358
• article
  https://github.com/FRRouting/frr/pull/14260
• report
  https://access.redhat.com/security/cve/CVE-2023-41359
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41359
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41359
• article
  https://github.com/FRRouting/frr/pull/14232
• report
  https://access.redhat.com/security/cve/CVE-2023-41360
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41360
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41360
• article
  https://github.com/FRRouting/frr/pull/14245
• report
  https://access.redhat.com/security/cve/CVE-2023-41909
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41909
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41909
• report
  https://access.redhat.com/security/cve/CVE-2023-46752
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-46752
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-46752
• article
  https://github.com/FRRouting/frr/pull/14645/commits/b08afc81c60607a4f736f418f2e3eb06087f1a35
• report
  https://access.redhat.com/security/cve/CVE-2023-46753