Summary
It was discovered that the Quagga BGP daemon did not properly check the
attribute length in NRLI. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2023-41358)
It was discovered that the Quagga BGP daemon did not properly manage memory
when reading initial bytes of ORF header. A remote attacker could possibly
use this issue to cause a denial of service. (CVE-2023-41360)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | quagga | 1.2.4-4ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | quagga | 0.99.24.1-2ubuntu1.4+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | quagga | 1.2.4-1ubuntu0.1~esm1 |
Vulnerabilities 2
-
Critical 9.1
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in …
-
Unscored —
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.