{"id":"CVE-2023-38283","aliases":["DEBIAN-CVE-2023-38283","EUVD-2023-42103","GHSA-q32v-3jr9-xvmc","UBUNTU-CVE-2023-38283"],"status":"published","title":"In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by...","description":"In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01359,"percentile":0.71924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-754"],"published":"2023-08-29T00:00:00Z","modified":"2026-11-10T12:10:00Z","fixes":[{"ecosystem":"Debian:13","package":"openbgpd","fixed_in":["8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openbgpd","fixed_in":["8.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openbgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.7-2","7.8-1","7.8-1~bpo11+1","7.9-1","7.9-1~bpo11+1","8.0-1","8.0-1~bpo11+1","8.0-2","8.1-1","8.1-1~bpo11+1","8.1-1~bpo12+1","8.1-2","8.2-1","8.2-1~bpo12+1","8.3-1","8.3-1~bpo12+1","8.4-1","8.4-1~bpo12+1","8.5-1","8.5-1~bpo12+1","8.6-1","8.6-1~bpo12+1","8.7-1","8.8-1","8.8-1~bpo12+1","8.9-1","8.9-1~bpo13+1","9.0-1","9.0-1~bpo13+1","9.1-1","9.1-1~bpo13+1","9.2-1","9.2-1~bpo13+1","9.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"openbgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openbgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openbgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0-1","7.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openbgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.1-1","8.3-1","8.3-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openbgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.8-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openbgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0-1","9.1-1","9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openbgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.8-1","8.9-1","9.0-1"]}],"products":[{"vendor":"bgp","product":"openbgpd"},{"vendor":"openbgpd","product":"openbgpd"}],"references":[{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig","tags":["x_transferred","Patch","web","report"]},{"url":"https://github.com/openbgpd-portable/openbgpd-portable/releases/tag/8.1","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling","tags":["x_transferred","Exploit","Third Party Advisory","article","report"]},{"url":"https://news.ycombinator.com/item?id=37305800","tags":["x_transferred","Mailing List","web","report"]},{"url":"https://www.openbsd.org/errata73.html","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38283","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q32v-3jr9-xvmc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38283.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-38283","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-38283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38283","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-38283","description":"In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2024-10-02T14:55:43.156Z","updated_at":"2026-11-02T14:35:29.772612Z"}],"euvd":[{"id":"EUVD-2023-42103","description":"In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2024-10-02T14:55:43Z","updated_at":"2026-11-03T00:27:58.959241Z"}],"ghsa":[{"id":"GHSA-q32v-3jr9-xvmc","title":"In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by...","description":"In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.","status":"published","published":"2023-08-29T18:31:53Z","modified":"2024-04-04T07:15:18Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:56:49.876332Z"}],"nvd":[{"id":"CVE-2023-38283","description":"In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.","status":"published","published":"2023-08-29T16:15:08.96Z","modified":"2026-11-10T12:10:00.177Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-754"],"updated_at":"2026-11-10T14:19:22.611066Z"}],"osv":[{"id":"DEBIAN-CVE-2023-38283","description":"In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.","status":"published","published":"2023-08-29T16:15:08.96Z","modified":"2026-10-26T18:01:52.816122231Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"UBUNTU-CVE-2023-38283","description":"In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.","status":"published","published":"2023-08-29T16:15:00Z","modified":"2026-10-17T12:57:20.534810609Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"CVE-2023-38283","description":"In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2026-10-28T02:30:47.492068285Z","updated_at":"2026-11-02T15:44:32.922049Z"}]}}