CVE-2023-41361
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
An issue was discovered in FRRouting FRR 9.0, where bgpd/bgp_open.c does not check for an overly large length of the rcv software version.
Risk Assessment
The lack of validation for the software version length may lead to potential attacks that could affect the stability and security of the system.
Recommendation
It is recommended to upgrade to the latest version of FRRouting that includes fixes for this vulnerability.
Other vulnerabilities in FRRouting FRR 9.0
See all- CVE-2023-41360Critical
An issue was discovered in FRRouting FRR through 9.0 that allows reading the initial byte of the ORF header in an ahead-of-stream situation.
- CVE-2023-41359Critical
An issue was discovered in FRRouting FRR through 9.0 related to an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c. There is no check for the availability of two bytes during AIGP validation.
- CVE-2023-41358High
An issue was discovered in FRRouting FRR through 9.0, where bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.
Original NVD description (English source)
An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.