Red Hat Security Advisory: frr security update

Fixed packages 4

Vulnerabilities 5

• Unscored —
  CVE-2023-31490

  An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_su…

  frr frr frr Debian Ubuntu Azure Linux
  May 9, 2023
• Unscored —
  CVE-2023-41358

  An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.

  frr frr quagga frr Debian Ubuntu Azure Linux
  Aug 29, 2023
• Unscored —
  CVE-2023-41909

  An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malforme…

  frr frr Debian Ubuntu
  Sep 5, 2023
• Unscored —
  CVE-2023-46752

  An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.

  frr frr frr Debian Ubuntu Azure Linux
  Oct 26, 2023
• Unscored —
  CVE-2023-46753

  An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mand…

  frr frr quagga frr Debian Ubuntu Azure Linux
  Oct 26, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2235839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237416
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2238992
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246381
• article
  https://issues.redhat.com/browse/RHEL-12039
• article
  https://issues.redhat.com/browse/RHEL-22303
• article
  https://issues.redhat.com/browse/RHEL-2263
• article
  https://issues.redhat.com/browse/RHEL-6583
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2981.json
• report
  https://access.redhat.com/security/cve/CVE-2023-31490
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-31490
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-31490
• report
  https://access.redhat.com/security/cve/CVE-2023-41358
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41358
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41358
• article
  https://github.com/FRRouting/frr/pull/14260
• report
  https://access.redhat.com/security/cve/CVE-2023-41909
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41909
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41909
• report
  https://access.redhat.com/security/cve/CVE-2023-46752
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-46752
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-46752
• article
  https://github.com/FRRouting/frr/pull/14645/commits/b08afc81c60607a4f736f418f2e3eb06087f1a35
• report
  https://access.redhat.com/security/cve/CVE-2023-46753
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-46753
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-46753
• article
  https://github.com/FRRouting/frr/pull/14645/commits/d8482bf011cb2b173e85b65b4bf3d5061250cdb9