Description
Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZcashFoundation | zebra | 2.3.0 – < 6.4.0 | 6.4.0 |
References
- GitHub Security Advisory (GHSA-jhpp-8h75-7pv5) vendor-advisory
- VulnCheck Advisory: Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying third-party-advisory