CVE-2023-38283
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by...
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
- Record
CVE-2023-38283- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-754
- Updated
- 2026-11-10
CVE List No score
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
- Record
CVE-2023-38283- Updated
- 2026-11-02
EUVDEUVD-2023-42103 No score
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
- Record
EUVD-2023-42103- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q32v-3jr9-xvmc
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by...
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
- Record
GHSA-q32v-3jr9-xvmc- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-754
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-38283
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
- Record
DEBIAN-CVE-2023-38283- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-38283
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
- Record
UBUNTU-CVE-2023-38283- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV No score
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
- Record
CVE-2023-38283- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openbgpdDebian:12 |
All versions, plus listed versions 7.7-27.8-17.8-1~bpo11+17.9-17.9-1~bpo11+1 Show 29 moreShow less8.0-18.0-1~bpo11+18.0-28.1-18.1-1~bpo11+18.1-1~bpo12+18.1-28.2-18.2-1~bpo12+18.3-18.3-1~bpo12+18.4-18.4-1~bpo12+18.5-18.5-1~bpo12+18.6-18.6-1~bpo12+18.7-18.8-18.8-1~bpo12+18.9-18.9-1~bpo13+19.0-19.0-1~bpo13+19.1-19.1-1~bpo13+19.2-19.2-1~bpo13+19.3-1 |
None known |
openbgpdDebian:13 |
before 8.1-1 | 8.1-1 |
openbgpdDebian:14 |
before 8.1-1 | 8.1-1 |
openbgpdUbuntu:22.04:LTS |
All versions, plus listed versions 7.0-17.2-1 |
None known |
openbgpdUbuntu:24.04:LTS |
All versions, plus listed versions 8.1-18.3-18.3-1build2 |
None known |
openbgpdUbuntu:25.10 |
All versions, plus listed versions 8.8-1 |
None known |
openbgpdUbuntu:26.10 |
All versions, plus listed versions 9.0-19.1-19.2-1 |
None known |
openbgpdUbuntu:26.04:LTS |
All versions, plus listed versions 8.8-18.9-19.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | NVD | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-38283 is a medium vulnerability (CVSS 5.3) in Bgp Openbgpd, published August 29, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. Fixed in openbgpd 8.1-1.