CVE-2023-38407 - Vulnerability Details

Vendors	Products
Frrouting	Frrouting
Redhat	Enterprise Linux Rhel Eus

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
frr-0:7.5.1-13.el8_9.3	cpe:/a:redhat:enterprise_linux:8	RHSA-2024:0130	2024-01-10T00:00:00Z
Red Hat Enterprise Linux 8.6 Extended Update Support
frr-0:7.5-11.el8_6.7	cpe:/a:redhat:rhel_eus:8.6	RHSA-2024:1113	2024-03-05T00:00:00Z
Red Hat Enterprise Linux 8.8 Extended Update Support
frr-0:7.5.1-7.el8_8.5	cpe:/a:redhat:rhel_eus:8.8	RHSA-2024:0574	2024-01-30T00:00:00Z
Red Hat Enterprise Linux 9
frr-0:8.3.1-11.el9_3.2	cpe:/a:redhat:enterprise_linux:9	RHSA-2024:0477	2024-01-25T00:00:00Z
Red Hat Enterprise Linux 9.0 Extended Update Support
frr-0:8.0-5.el9_0.3	cpe:/a:redhat:rhel_eus:9.0	RHSA-2024:1152	2024-03-05T00:00:00Z
Red Hat Enterprise Linux 9.2 Extended Update Support
frr-0:8.3.1-5.el9_2.4	cpe:/a:redhat:rhel_eus:9.2	RHSA-2024:1093	2024-03-05T00:00:00Z

Link	Providers
https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5
https://github.com/FRRouting/frr/pull/12951
https://github.com/FRRouting/frr/pull/12956
https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html
https://nvd.nist.gov/vuln/detail/CVE-2023-38407
https://www.cve.org/CVERecord?id=CVE-2023-38407

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-38407", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T17:39:13.524Z", "dateReserved": "2023-07-17T00:00:00", "datePublished": "2023-11-06T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-28T07:06:10.226370"}, "descriptions": [{"lang": "en", "value": "bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/FRRouting/frr/pull/12951"}, {"url": "https://github.com/FRRouting/frr/pull/12956"}, {"url": "https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5"}, {"name": "[debian-lts-announce] 20240428 [SECURITY] [DLA 3797-1] frr security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"affected": [{"vendor": "frrouting", "product": "frrouting", "cpes": ["cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "8.5", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-01T14:53:35.844035Z", "id": "CVE-2023-38407", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-05T20:28:40.231Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:39:13.524Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/FRRouting/frr/pull/12951", "tags": ["x_transferred"]}, {"url": "https://github.com/FRRouting/frr/pull/12956", "tags": ["x_transferred"]}, {"url": "https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20240428 [SECURITY] [DLA 3797-1] frr security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html"}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2023-38407 (string)

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

assignerShortName : mitre (string)

dateUpdated : 2024-08-02T17:39:13.524Z (string)

dateReserved : 2023-07-17T00:00:00 (string)

datePublished : 2023-11-06T00:00:00 (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

dateUpdated : 2024-04-28T07:06:10.226370 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing. (string)

}

]

affected : [ »

0 : { »

vendor : n/a (string)

product : n/a (string)

versions : [ »

0 : { »

version : n/a (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

url : https://github.com/FRRouting/frr/pull/12951 (string)

}

1 : { »

url : https://github.com/FRRouting/frr/pull/12956 (string)

}

2 : { »

url : https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5 (string)

}

3 : { »

name : [debian-lts-announce] 20240428 [SECURITY] [DLA 3797-1] frr security update (string)

tags : [ »

0 : mailing-list (string)

]

url : https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : n/a (string)

}

]

}

]

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : frrouting (string)

product : frrouting (string)

cpes : [ »

0 : cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThan : 8.5 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-05-01T14:53:35.844035Z (string)

id : CVE-2023-38407 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-06-05T20:28:40.231Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T17:39:13.524Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://github.com/FRRouting/frr/pull/12951 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://github.com/FRRouting/frr/pull/12956 (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5 (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

name : [debian-lts-announce] 20240428 [SECURITY] [DLA 3797-1] frr security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_transferred (string)

]

url : https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html (string)

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/FRRouting/frr/pull/12951", "tags": ["x_transferred"]}, {"url": "https://github.com/FRRouting/frr/pull/12956", "tags": ["x_transferred"]}, {"url": "https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html", "name": "[debian-lts-announce] 20240428 [SECURITY] [DLA 3797-1] frr security update", "tags": ["mailing-list", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:39:13.524Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-38407", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-01T14:53:35.844035Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*"], "vendor": "frrouting", "product": "frrouting", "versions": [{"status": "affected", "version": "0", "lessThan": "8.5", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-01T15:08:37.484Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/FRRouting/frr/pull/12951"}, {"url": "https://github.com/FRRouting/frr/pull/12956"}, {"url": "https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html", "name": "[debian-lts-announce] 20240428 [SECURITY] [DLA 3797-1] frr security update", "tags": ["mailing-list"]}], "descriptions": [{"lang": "en", "value": "bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-28T07:06:10.226370"}}}, "cveMetadata": {"cveId": "CVE-2023-38407", "state": "PUBLISHED", "dateUpdated": "2024-08-02T17:39:13.524Z", "dateReserved": "2023-07-17T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-11-06T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://github.com/FRRouting/frr/pull/12951 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://github.com/FRRouting/frr/pull/12956 (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5 (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html (string)

name : [debian-lts-announce] 20240428 [SECURITY] [DLA 3797-1] frr security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T17:39:13.524Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-38407 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-05-01T14:53:35.844035Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:* (string)

]

vendor : frrouting (string)

product : frrouting (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 8.5 (string)

versionType : custom (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-05-01T15:08:37.484Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : n/a (string)

product : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

references : [ »

0 : { »

url : https://github.com/FRRouting/frr/pull/12951 (string)

}

1 : { »

url : https://github.com/FRRouting/frr/pull/12956 (string)

}

2 : { »

url : https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5 (string)

}

3 : { »

url : https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html (string)

name : [debian-lts-announce] 20240428 [SECURITY] [DLA 3797-1] frr security update (string)

tags : [ »

0 : mailing-list (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : n/a (string)

}

]

}

]

providerMetadata : { »

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

dateUpdated : 2024-04-28T07:06:10.226370 (string)

}

cveMetadata : { »

cveId : CVE-2023-38407 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-02T17:39:13.524Z (string)

dateReserved : 2023-07-17T00:00:00 (string)

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

datePublished : 2023-11-06T00:00:00 (string)

assignerShortName : mitre (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB0E7F12-AAE7-48DA-B684-585BA3188B28", "versionEndExcluding": "8.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing."}, {"lang": "es", "value": "bgpd/bgp_label.c en FRRouting (FRR) antes de 8.5 intenta leer m\u00e1s all\u00e1 del final de la secuencia durante el an\u00e1lisis de unicast etiquetado."}], "id": "CVE-2023-38407", "lastModified": "2024-11-21T08:13:30.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-11-06T06:15:40.907", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/FRRouting/frr/pull/12951"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/FRRouting/frr/pull/12956"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/FRRouting/frr/pull/12951"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/FRRouting/frr/pull/12956"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:* (string)

matchCriteriaId : AB0E7F12-AAE7-48DA-B684-585BA3188B28 (string)

versionEndExcluding : 8.5 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing. (string)

}

1 : { »

lang : es (string)

value : bgpd/bgp_label.c en FRRouting (FRR) antes de 8.5 intenta leer más allá del final de la secuencia durante el análisis de unicast etiquetado. (string)

}

]

id : CVE-2023-38407 (string)

lastModified : 2024-11-21T08:13:30.293 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2023-11-06T06:15:40.907 (string)

references : [ »

0 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5 (string)

}

1 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/FRRouting/frr/pull/12951 (string)

}

2 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/FRRouting/frr/pull/12956 (string)

}

3 : { »

source : cve@mitre.org (string)

url : https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/FRRouting/frr/pull/12951 (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/FRRouting/frr/pull/12956 (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html (string)

}

]

sourceIdentifier : cve@mitre.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2024:0130", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "frr-0:7.5.1-13.el8_9.3", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-01-10T00:00:00Z"}, {"advisory": "RHSA-2024:1113", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "frr-0:7.5-11.el8_6.7", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2024-03-05T00:00:00Z"}, {"advisory": "RHSA-2024:0574", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "frr-0:7.5.1-7.el8_8.5", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-01-30T00:00:00Z"}, {"advisory": "RHSA-2024:0477", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "frr-0:8.3.1-11.el9_3.2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-01-25T00:00:00Z"}, {"advisory": "RHSA-2024:1152", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "frr-0:8.0-5.el9_0.3", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2024-03-05T00:00:00Z"}, {"advisory": "RHSA-2024:1093", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "frr-0:8.3.1-5.el9_2.4", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-03-05T00:00:00Z"}], "bugzilla": {"description": "ffr: Out of bounds read in bgpd/bgp_label.c", "id": "2248528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248528"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-125", "details": ["bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.", "An out-of-bounds read flaw was found in FFrounting beyond the end of the stream during labeled unicast parsing. This issue may lead to application crash and denial of service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2023-38407", "public_date": "2023-03-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-38407\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-38407\nhttps://github.com/FRRouting/frr/pull/12951\nhttps://github.com/FRRouting/frr/pull/12956"], "statement": "Red Hat OpenStack Platform does not ship its own version of the frr package, instead using the version from the underlying Red Hat Enterprise Linux. RHOSP is marked as Not Affected as no changes need to be made by the OpenStack engineering team. System administrators of OpenStack deployments should apply updates once available in RHEL.", "threat_severity": "Moderate"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2024:0130 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : frr-0:7.5.1-13.el8_9.3 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2024-01-10T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2024:1113 (string)

cpe : cpe:/a:redhat:rhel_eus:8.6 (string)

package : frr-0:7.5-11.el8_6.7 (string)

product_name : Red Hat Enterprise Linux 8.6 Extended Update Support (string)

release_date : 2024-03-05T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2024:0574 (string)

cpe : cpe:/a:redhat:rhel_eus:8.8 (string)

package : frr-0:7.5.1-7.el8_8.5 (string)

product_name : Red Hat Enterprise Linux 8.8 Extended Update Support (string)

release_date : 2024-01-30T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2024:0477 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : frr-0:8.3.1-11.el9_3.2 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2024-01-25T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2024:1152 (string)

cpe : cpe:/a:redhat:rhel_eus:9.0 (string)

package : frr-0:8.0-5.el9_0.3 (string)

product_name : Red Hat Enterprise Linux 9.0 Extended Update Support (string)

release_date : 2024-03-05T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2024:1093 (string)

cpe : cpe:/a:redhat:rhel_eus:9.2 (string)

package : frr-0:8.3.1-5.el9_2.4 (string)

product_name : Red Hat Enterprise Linux 9.2 Extended Update Support (string)

release_date : 2024-03-05T00:00:00Z (string)

}

]

bugzilla : { »

description : ffr: Out of bounds read in bgpd/bgp_label.c (string)

id : 2248528 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2248528 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 7.5 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

status : verified (string)

}

cwe : CWE-125 (string)

details : [ »

0 : bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing. (string)

1 : An out-of-bounds read flaw was found in FFrounting beyond the end of the stream during labeled unicast parsing. This issue may lead to application crash and denial of service. (string)

]

mitigation : { »

lang : en:us (string)

value : Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. (string)

}

name : CVE-2023-38407 (string)

public_date : 2023-03-05T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2023-38407 https://nvd.nist.gov/vuln/detail/CVE-2023-38407 https://github.com/FRRouting/frr/pull/12951 https://github.com/FRRouting/frr/pull/12956 (string)

]

statement : Red Hat OpenStack Platform does not ship its own version of the frr package, instead using the version from the underlying Red Hat Enterprise Linux. RHOSP is marked as Not Affected as no changes need to be made by the OpenStack engineering team. System administrators of OpenStack deployments should apply updates once available in RHEL. (string)

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object