Design/Logic Flaw

Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations...

CVE-2023-34041

CVE-2023-34041 affects Cloud Foundry Router (gorouter) releases before 0.278.0, where HTTP Hop-by-Hop headers (notably B3 and X-B3-SpanID) can be abused to alter the identifiers logged in foundations. Exploitation requires no authentication and can influence log-trace values, per multiple sources...

CVE-2023-34041 CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter

Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations...

Cloud Foundry Routing Security Vulnerability

Cloud Foundry is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from the U.S.-based Cloud Foundry Foundation. The product provides features such as container scheduling, continuous delivery and automated service deployment. A security vulnerability exists in Cloud...

PT-2023-24652 · Cloud Foundry · Cloud Foundry Routing

Name of the Vulnerable Software and Affected Versions: Cloud Foundry Routing versions prior to 0.278.0 Description: The issue allows an unauthenticated attacker to abuse HTTP Hop-by-Hop Headers, affecting the identification value recorded in logs. Specifically, headers like B3 or X-B3-SpanID can ...

SUSE CVE-2023-41909

An issue was discovered in FRRouting FRR through 9.0. bgpnlriparseflowspec in bgpd/bgpflowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference...

FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).

...

An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.

...

FRRouting FRR Code Issue Vulnerability

FRRouting FRR is a suite of software that implements and manages various IPV4 and IPV6 routing protocols. A security vulnerability exists in FRRouting FRR, which stems from bgpnlriparseflowspec in bgpd/bgpflowspec.c, which handles special requests and causes null pointer dereferences...

The vulnerability of the Border Gateway Protocol BGP implementation by the Routing Protocol Daemon (rpd) in Juniper Networks’ Junos OS and Junos OS Evolved operating systems allows a attacker to cause service interruptions.

The vulnerability of the Border Gateway Protocol BGP implementation of the Routing Protocol Daemon rpd in Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause servi...

CVE-2023-41627

O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device...

CVE-2023-41627

O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device...

CVE-2023-41627

O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device...

Code injection

O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device...

CVE-2023-4481

An Improper Input Validation vulnerability in the Routing Protocol Daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service DoS. When certain specific crafted BGP UPDATE messages are received over an established BG...

Input validation

An Improper Input Validation vulnerability in the Routing Protocol Daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service DoS. When certain specific crafted BGP UPDATE messages are received over an established BG...

PT-2023-28007 · O Ran Software Community · Ric-Plt-Lib-Rmr

Name of the Vulnerable Software and Affected Versions: O-RAN Software Community ric-plt-lib-rmr version 4.9.0 Description: The issue is related to the lack of validation of the source of routing tables received by the device, potentially allowing attackers to send forged routing tables. This coul...

CVE-2023-41627

O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device...

ric-plt-lib-rmr security vulnerability

ric-plt-lib-rmr is an open source message router library from O-RAN Software Community. Applications can use it to send messages to other RMR-based applications. A security vulnerability exists in ric-plt-lib-rmr version v4.9.0, which originates from not verifying the source of a received routing...

CVE-2023-41627

The CVE-2023-41627 issue affects O-RAN Software Community ric-plt-lib-rmr v4.9.0, where routing-table sources are not validated, enabling forged routing tables to be sent to a device. Multiple sources (Red Hat, NVD/CVE records, CNNVD, PRION, and PT-Security) corroborate this description. Impact i...