Описание
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 4.5.0-1 |
| esm-apps/bionic | not-affected | 1.29-1ubuntu0.1+esm1 |
| esm-apps/focal | not-affected | 2.12.0-1ubuntu0.1~esm2 |
| esm-apps/jammy | not-affected | 2.25.0-3ubuntu0.1+esm3 |
| esm-apps/noble | not-affected | 3.23.0-1ubuntu0.3+esm3 |
| esm-apps/resolute | not-affected | 3.36.0-2build1 |
| jammy | not-affected | 2.25.0-3ubuntu0.1 |
| noble | not-affected | 3.23.0-1ubuntu0.3 |
| questing | not-affected | 3.36.0-2 |
| resolute | not-affected | 3.36.0-2build1 |
Показывать по
Ссылки на источники
EPSS
7.5 High
CVSS3
Связанные уязвимости
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.
GoBGP is an open source Border Gateway Protocol (BGP) implementation i ...
GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
EPSS
7.5 High
CVSS3