Lucene search

K
oraclelinuxOracleLinuxELSA-2024-2981
HistoryMay 23, 2024 - 12:00 a.m.

frr security update

2024-05-2300:00:00
linux.oracle.com
2
postin scriptlet fix
rhel-15916
flowspec overflow
rhel-15919
out of bounds read
rhel-15869
crash
rhel-15868
eor message
rhel-22303
zebra
rhel-2216
null pointer dereference
rhel-4797
dos
rhel-14824
crafted bgp message
rhel-14821
mishandled data
rhel-6583
route refresh issue
rhel-12039
plist update crash
rhel-6617
invalid bgp update.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.2 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.1%

[7.5.1-22.0.1]

  • Fix POSTIN scriptlet [Orabug: 34712485]
  • Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgp_flowspec.c
  • Resolves: RHEL-15919 - Out of bounds read in bgpd/bgp_label.c
  • Resolves: RHEL-15869 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
  • Resolves: RHEL-15868 - crash from malformed EOR-containing BGP UPDATE message
    [7.5.1-22]
  • Resolves: RHEL-22303 - Zebra not fetching host routes
    [7.5.1-21]
  • Resolves: RHEL-2216 - NULL pointer dereference
    [7.5.1-20]
  • Resolves: RHEL-4797 - missing length check in bgp_attr_psid_sub() can lead do DoS
    [7.5.1-19]
  • Resolves: RHEL-14824 - crafted BGP UPDATE message leading to a crash
    [7.5.1-18]
  • Resolves: RHEL-14821 - mishandled malformed data leading to a crash
    [7.5.1-17]
  • Resolves: RHEL-6583 - Routes are not refreshed after changing the inbound route rules from deny to permit
    [7.5.1-16]
  • Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgp_flowspec.c
  • Resolves: RHEL-15919 - Out of bounds read in bgpd/bgp_label.c
  • Resolves: RHEL-15869 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
  • Resolves: RHEL-15868 - crash from malformed EOR-containing BGP UPDATE message
    [7.5.1-15]
  • Resolves: RHEL-12039 - crash in plist update
    [7.5.1-14]
  • Resolves: RHEL-6617 - Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.2 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.1%