{"id":"CVE-2020-12831","aliases":["ALSA-2020:4619","DEBIAN-CVE-2020-12831","EUVD-2020-5113","GHSA-x83m-q23q-xv5j","RHSA-2020:4619","openSUSE-SU-2024:10583-1"],"status":"disputed","title":"** DISPUTED ** An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1....","description":"An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01432,"percentile":0.7327,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-732"],"published":"2020-05-13T17:42:36Z","modified":"2026-10-29T11:00:17Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"frr-contrib","fixed_in":["7.0-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr","fixed_in":["0:7.0-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-contrib","fixed_in":["0:7.0-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-debuginfo","fixed_in":["0:7.0-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-debugsource","fixed_in":["0:7.0-10.el8"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"frr","fixed_in":["7.5.1-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"frr-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0-10.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0-0.1","10.0-0.2","10.0-1","10.0-2","10.0.1-0.1","10.1-0.1","10.1-0.2","10.1.1-0.1","10.1.1-1","10.1.1-2","10.1.1-3","10.2-1","10.2-2","10.2.1-1","10.2.1-2","10.2.1-3","10.2.1-4","10.2.1-5","10.2.1-6","10.3-1","10.3-2","10.3-3","10.3-4","10.3-5","10.3.1-1","10.3.1-2","10.3.1-3","10.3.1-4","10.4.0-1","10.4.1-1","10.4.1-2","10.4.1-3","10.5.0-1","10.5.0-2","10.5.1-1","10.5.1-2","10.5.1-3","10.5.2-1","10.5.3-1","10.6.0-1","10.6.0-2","10.6.1-1","10.6.1-2","10.6.1-3","10.7.0-1","10.7.0-2","10.7.1-1","10.7.1-2","10.7.1-3","10.7.1-4","10.7.1-5","10.7.1-6","8.4.2-1","8.4.4-1","8.4.4-1.1","8.4.4-1.1~deb12u1","8.4.4-1.1~deb12u2","9.1-0.1"]},{"source":"osv","ecosystem":"Debian:13","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.3-3","10.3-3+deb13u1","10.3-4","10.3-5","10.3.1-1","10.3.1-2","10.3.1-3","10.3.1-4","10.4.0-1","10.4.1-1","10.4.1-2","10.4.1-3","10.5.0-1","10.5.0-2","10.5.1-1","10.5.1-2","10.5.1-3","10.5.2-1","10.5.3-1","10.6.0-1","10.6.0-2","10.6.1-1","10.6.1-2","10.6.1-3","10.7.0-1","10.7.0-2","10.7.1-1","10.7.1-2","10.7.1-3","10.7.1-4","10.7.1-5","10.7.1-6"]},{"source":"osv","ecosystem":"Debian:14","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.3-3","10.3-4","10.3-5","10.3.1-1","10.3.1-2","10.3.1-3","10.3.1-4","10.4.0-1","10.4.1-1","10.4.1-2","10.4.1-3","10.5.0-1","10.5.0-2","10.5.1-1","10.5.1-2","10.5.1-3","10.5.2-1","10.5.3-1","10.6.0-1","10.6.0-2","10.6.1-1","10.6.1-2","10.6.1-3","10.7.0-1","10.7.0-2","10.7.1-1","10.7.1-2","10.7.1-3","10.7.1-4","10.7.1-5","10.7.1-6"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-10.el8"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-3.1"}]}]}],"products":[{"vendor":"linuxfoundation","product":"free_range_routing"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830805","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://github.com/FRRouting/frr/pull/6383","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12831","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x83m-q23q-xv5j"},{"url":"https://vulners.com/cve/CVE-2020-12831","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-12831","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4619","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1758544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1776342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1867793","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4619.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12831","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12831","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-12831","description":"An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file","status":"disputed","published":"2020-05-13T17:42:36Z","modified":"2024-08-04T12:04:22.891Z","updated_at":"2026-11-02T14:35:53.236501Z"}],"euvd":[{"id":"EUVD-2020-5113","description":"An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file","status":"published","published":"2020-05-13T17:42:36Z","modified":"2024-08-04T12:04:22Z","updated_at":"2026-11-03T03:07:39.298733Z"}],"ghsa":[{"id":"GHSA-x83m-q23q-xv5j","title":"** DISPUTED ** An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1....","description":"** DISPUTED ** An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file.","status":"published","published":"2022-05-24T17:17:46Z","modified":"2024-03-21T03:33:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-732"],"updated_at":"2026-11-02T14:55:42.026509Z"}],"nvd":[{"id":"CVE-2020-12831","description":"An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file","status":"disputed","published":"2020-05-13T18:15:12.047Z","modified":"2026-06-17T02:52:23.643Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"CVE-2020-12831","description":"An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file","status":"published","published":"2020-05-13T18:15:12.047Z","modified":"2026-10-20T10:51:08.646539245Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-12831","description":"An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file","status":"published","published":"2020-05-13T18:15:12.047Z","modified":"2026-10-26T12:02:25.38705483Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"RHSA-2020:4619","title":"Red Hat Security Advisory: frr security and bug fix update","status":"published","published":"2024-09-16T03:40:28Z","modified":"2026-01-14T11:02:55.666475Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"ALSA-2020:4619","title":"Moderate: frr security and bug fix update","description":"FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. \n\nSecurity Fix(es):\n\n* frr: default permission issue eases information leaks (CVE-2020-12831)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:21:03Z","modified":"2026-10-29T11:00:17.174542841Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"openSUSE-SU-2024:10583-1","title":"frr-7.5.1-3.1 on GA media","description":"These are all security issues fixed in the frr-7.5.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:05.269835Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}