RHEL 9 : frr (RHSA-2024:0477)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0477 advisory. FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR,...

CVE-2023-38406

bgpd/bgpflowspec.c in FRRouting FRR before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."...

CVE-2023-41909

An issue was discovered in FRRouting FRR through 9.0. bgpnlriparseflowspec in bgpd/bgpflowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference...

CVE-2023-41909

CVE-2023-41909 affects FRRouting FRR instances with the BGP flowspec feature. The flaw is a NULL pointer dereference in bgpd/bgp_flowspec.c when processing malformed requests with no attributes, potentially enabling a crash or denial of service under certain BGP flowspec conditions (reported for ...