Описание
Security update for frr
This update for frr fixes the following issues:
- CVE-2023-38802: Fixed bad length handling when processing BGP attributes. (bsc#1213284)
- CVE-2023-41358: Fixed a possible crash when processing NLRIs with an attribute length of zero. (bsc#1214735)
- CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec (bsc#1215065).
Список пакетов
SUSE Enterprise Storage 7.1
frr-7.4-150300.4.17.1
frr-devel-7.4-150300.4.17.1
libfrr0-7.4-150300.4.17.1
libfrr_pb0-7.4-150300.4.17.1
libfrrcares0-7.4-150300.4.17.1
libfrrfpm_pb0-7.4-150300.4.17.1
libfrrgrpc_pb0-7.4-150300.4.17.1
libfrrospfapiclient0-7.4-150300.4.17.1
libfrrsnmp0-7.4-150300.4.17.1
libfrrzmq0-7.4-150300.4.17.1
libmlag_pb0-7.4-150300.4.17.1
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS
frr-7.4-150300.4.17.1
frr-devel-7.4-150300.4.17.1
libfrr0-7.4-150300.4.17.1
libfrr_pb0-7.4-150300.4.17.1
libfrrcares0-7.4-150300.4.17.1
libfrrfpm_pb0-7.4-150300.4.17.1
libfrrgrpc_pb0-7.4-150300.4.17.1
libfrrospfapiclient0-7.4-150300.4.17.1
libfrrsnmp0-7.4-150300.4.17.1
libfrrzmq0-7.4-150300.4.17.1
libmlag_pb0-7.4-150300.4.17.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
frr-7.4-150300.4.17.1
frr-devel-7.4-150300.4.17.1
libfrr0-7.4-150300.4.17.1
libfrr_pb0-7.4-150300.4.17.1
libfrrcares0-7.4-150300.4.17.1
libfrrfpm_pb0-7.4-150300.4.17.1
libfrrgrpc_pb0-7.4-150300.4.17.1
libfrrospfapiclient0-7.4-150300.4.17.1
libfrrsnmp0-7.4-150300.4.17.1
libfrrzmq0-7.4-150300.4.17.1
libmlag_pb0-7.4-150300.4.17.1
SUSE Linux Enterprise Module for Server Applications 15 SP4
frr-7.4-150300.4.17.1
frr-devel-7.4-150300.4.17.1
libfrr0-7.4-150300.4.17.1
libfrr_pb0-7.4-150300.4.17.1
libfrrcares0-7.4-150300.4.17.1
libfrrfpm_pb0-7.4-150300.4.17.1
libfrrgrpc_pb0-7.4-150300.4.17.1
libfrrospfapiclient0-7.4-150300.4.17.1
libfrrsnmp0-7.4-150300.4.17.1
libfrrzmq0-7.4-150300.4.17.1
libmlag_pb0-7.4-150300.4.17.1
SUSE Linux Enterprise Server 15 SP3-LTSS
frr-7.4-150300.4.17.1
frr-devel-7.4-150300.4.17.1
libfrr0-7.4-150300.4.17.1
libfrr_pb0-7.4-150300.4.17.1
libfrrcares0-7.4-150300.4.17.1
libfrrfpm_pb0-7.4-150300.4.17.1
libfrrgrpc_pb0-7.4-150300.4.17.1
libfrrospfapiclient0-7.4-150300.4.17.1
libfrrsnmp0-7.4-150300.4.17.1
libfrrzmq0-7.4-150300.4.17.1
libmlag_pb0-7.4-150300.4.17.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3
frr-7.4-150300.4.17.1
frr-devel-7.4-150300.4.17.1
libfrr0-7.4-150300.4.17.1
libfrr_pb0-7.4-150300.4.17.1
libfrrcares0-7.4-150300.4.17.1
libfrrfpm_pb0-7.4-150300.4.17.1
libfrrgrpc_pb0-7.4-150300.4.17.1
libfrrospfapiclient0-7.4-150300.4.17.1
libfrrsnmp0-7.4-150300.4.17.1
libfrrzmq0-7.4-150300.4.17.1
libmlag_pb0-7.4-150300.4.17.1
SUSE Manager Proxy 4.2
frr-7.4-150300.4.17.1
frr-devel-7.4-150300.4.17.1
libfrr0-7.4-150300.4.17.1
libfrr_pb0-7.4-150300.4.17.1
libfrrcares0-7.4-150300.4.17.1
libfrrfpm_pb0-7.4-150300.4.17.1
libfrrgrpc_pb0-7.4-150300.4.17.1
libfrrospfapiclient0-7.4-150300.4.17.1
libfrrsnmp0-7.4-150300.4.17.1
libfrrzmq0-7.4-150300.4.17.1
libmlag_pb0-7.4-150300.4.17.1
SUSE Manager Server 4.2
frr-7.4-150300.4.17.1
frr-devel-7.4-150300.4.17.1
libfrr0-7.4-150300.4.17.1
libfrr_pb0-7.4-150300.4.17.1
libfrrcares0-7.4-150300.4.17.1
libfrrfpm_pb0-7.4-150300.4.17.1
libfrrgrpc_pb0-7.4-150300.4.17.1
libfrrospfapiclient0-7.4-150300.4.17.1
libfrrsnmp0-7.4-150300.4.17.1
libfrrzmq0-7.4-150300.4.17.1
libmlag_pb0-7.4-150300.4.17.1
openSUSE Leap 15.4
frr-7.4-150300.4.17.1
frr-devel-7.4-150300.4.17.1
libfrr0-7.4-150300.4.17.1
libfrr_pb0-7.4-150300.4.17.1
libfrrcares0-7.4-150300.4.17.1
libfrrfpm_pb0-7.4-150300.4.17.1
libfrrgrpc_pb0-7.4-150300.4.17.1
libfrrospfapiclient0-7.4-150300.4.17.1
libfrrsnmp0-7.4-150300.4.17.1
libfrrzmq0-7.4-150300.4.17.1
libmlag_pb0-7.4-150300.4.17.1
Ссылки
- Link for SUSE-SU-2023:3762-1
- E-Mail link for SUSE-SU-2023:3762-1
- SUSE Security Ratings
- SUSE Bug 1213284
- SUSE Bug 1214735
- SUSE Bug 1215065
- SUSE CVE CVE-2023-38802 page
- SUSE CVE CVE-2023-41358 page
- SUSE CVE CVE-2023-41909 page
Описание
FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).
Затронутые продукты
SUSE Enterprise Storage 7.1:frr-7.4-150300.4.17.1
SUSE Enterprise Storage 7.1:frr-devel-7.4-150300.4.17.1
SUSE Enterprise Storage 7.1:libfrr0-7.4-150300.4.17.1
SUSE Enterprise Storage 7.1:libfrr_pb0-7.4-150300.4.17.1
Ссылки
- CVE-2023-38802
- SUSE Bug 1213284
Описание
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.
Затронутые продукты
SUSE Enterprise Storage 7.1:frr-7.4-150300.4.17.1
SUSE Enterprise Storage 7.1:frr-devel-7.4-150300.4.17.1
SUSE Enterprise Storage 7.1:libfrr0-7.4-150300.4.17.1
SUSE Enterprise Storage 7.1:libfrr_pb0-7.4-150300.4.17.1
Ссылки
- CVE-2023-41358
- SUSE Bug 1214735
Описание
An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.
Затронутые продукты
SUSE Enterprise Storage 7.1:frr-7.4-150300.4.17.1
SUSE Enterprise Storage 7.1:frr-devel-7.4-150300.4.17.1
SUSE Enterprise Storage 7.1:libfrr0-7.4-150300.4.17.1
SUSE Enterprise Storage 7.1:libfrr_pb0-7.4-150300.4.17.1
Ссылки
- CVE-2023-41909
- SUSE Bug 1215065