NULL Pointer Dereference Affecting frr package, versions <7.5.1-1.1+deb10u1
Threat Intelligence
EPSS
0.07% (33rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN10-FRR-5864992
- published 30 Aug 2023
- disclosed 29 Aug 2023
Introduced: 29 Aug 2023
CVE-2023-41358 Open this link in a new tabHow to fix?
Upgrade Debian:10 frr to version 7.5.1-1.1+deb10u1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream frr package and not the frr package as distributed by Debian.
See How to fix? for Debian:10 relevant fixed versions and status.
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.
References
- https://security-tracker.debian.org/tracker/CVE-2023-41358
- https://github.com/FRRouting/frr/pull/14260
- https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html
- https://www.debian.org/security/2023/dsa-5495
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4/
CVSS Scores
version 3.1