{"id":"CVE-2023-38802","aliases":["ALSA-2023:5194","ALSA-2023:5219","AZL-28614","DEBIAN-CVE-2023-38802","DLA-3573-1","DSA-5495-1","EUVD-2023-42575","GHSA-xh4f-v933-c556","RHSA-2023:5194","RHSA-2023:5195","RHSA-2023:5196","RHSA-2023:5219","RHSA-2023:5457","RHSA-2023:5464","RHSA-2023:5465","SUSE-SU-2023:3709-1","SUSE-SU-2023:3762-1","SUSE-SU-2023:3793-1","SUSE-SU-2023:3836-1","SUSE-SU-2023:3839-1","SUSE-SU-2024:4090-1","UBUNTU-CVE-2023-38802","USN-6323-1","USN-6807-1","openSUSE-SU-2024:13191-1"],"status":"published","title":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial...","description":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02376,"percentile":0.84081,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-354"],"published":"2023-08-28T00:00:00Z","modified":"2026-10-30T02:45:31Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"frr","fixed_in":["8.3.1-5.el9_2.2.alma"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"frr-selinux","fixed_in":["8.3.1-5.el9_2.2.alma"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"frr","fixed_in":["7.5.1-7.el8_8.2.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"frr-selinux","fixed_in":["7.5.1-7.el8_8.2.alma.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"frr","fixed_in":["8.5.3-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"frr","fixed_in":["8.4.4-1.1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"frr","fixed_in":["8.4.4-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"frr","fixed_in":["8.4.4-1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr","fixed_in":["0:8.3.1-5.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-debuginfo","fixed_in":["0:8.3.1-5.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-debugsource","fixed_in":["0:8.3.1-5.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-selinux","fixed_in":["0:8.3.1-5.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"frr","fixed_in":["0:7.5-11.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"frr-debuginfo","fixed_in":["0:7.5-11.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"frr-debugsource","fixed_in":["0:7.5-11.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"frr","fixed_in":["0:7.5-4.el8_4.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"frr-debuginfo","fixed_in":["0:7.5-4.el8_4.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"frr-debugsource","fixed_in":["0:7.5-4.el8_4.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"frr","fixed_in":["0:7.5-4.el8_4.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"frr-debuginfo","fixed_in":["0:7.5-4.el8_4.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"frr-debugsource","fixed_in":["0:7.5-4.el8_4.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"frr","fixed_in":["0:7.5-4.el8_4.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"frr-debuginfo","fixed_in":["0:7.5-4.el8_4.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"frr-debugsource","fixed_in":["0:7.5-4.el8_4.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr","fixed_in":["0:7.5.1-7.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-debuginfo","fixed_in":["0:7.5.1-7.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-debugsource","fixed_in":["0:7.5.1-7.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-selinux","fixed_in":["0:7.5.1-7.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"frr","fixed_in":["0:8.0-5.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"frr-debuginfo","fixed_in":["0:8.0-5.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"frr-debugsource","fixed_in":["0:8.0-5.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"frr","fixed_in":["0:7.0-5.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"frr-contrib","fixed_in":["0:7.0-5.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"frr-debuginfo","fixed_in":["0:7.0-5.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"frr-debugsource","fixed_in":["0:7.0-5.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"frr","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"frr-contrib","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"frr-debuginfo","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"frr-debugsource","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"frr","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"frr-contrib","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"frr-debuginfo","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"frr-debugsource","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"frr","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"frr-contrib","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"frr-debuginfo","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"frr-debugsource","fixed_in":["0:7.0-5.el8_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","fixed_in":["7.2.1-1ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"frr","fixed_in":["8.1-1ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.1-5.el9_2.2.alma"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.1-5.el9_2.2.alma"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-7.el8_8.2.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-7.el8_8.2.alma.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.3-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1~deb12u1"}]}],"versions":["8.4.2-1","8.4.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-1.1+deb10u1"}]}],"versions":["6.0.2-2","6.0.2-2+deb10u1","6.0.2-2+deb10u2","7.2-1","7.2.1-1","7.3.1-1","7.4-1","7.4-1.1","7.4-2","7.5-1","7.5.1-1","7.5.1-1.1"],"bundled":10},{"source":"osv","ecosystem":"Debian:11","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-1.1+deb11u2"}]}],"versions":["7.5.1-1.1","7.5.1-1.1+deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1~deb12u1"}]}],"versions":["8.4.2-1","8.4.4-1"],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.1-5.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.1-5.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.1-5.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.1-5.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-11.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-11.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-11.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-4.el8_4.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-4.el8_4.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-4.el8_4.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-4.el8_4.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-4.el8_4.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-4.el8_4.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-4.el8_4.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-4.el8_4.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5-4.el8_4.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.1-7.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.1-7.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.1-7.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.1-7.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0-5.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0-5.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0-5.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"frr-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"frr-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"frr-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"frr-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0-5.el8_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-17.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-17.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-17.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150400.12.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150400.12.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150400.12.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150400.12.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm2"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2","7.2.1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.5"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.5"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm2"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2","7.2.1-1ubuntu0.2+esm1"],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-5.1"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"frrouting","product":"frrouting"},{"vendor":"pica8","product":"picos"}],"references":[{"url":"https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling","tags":["x_transferred","Exploit","Technical Description","Third Party Advisory","article","report"]},{"url":"https://news.ycombinator.com/item?id=37305800","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://www.debian.org/security/2023/dsa-5495","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/","tags":["vendor-advisory","x_transferred","Mailing List","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/","tags":["vendor-advisory","x_transferred","Mailing List","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4/","tags":["vendor-advisory","x_transferred","Mailing List","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38802","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xh4f-v933-c556","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5194","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38802","tags":["report"]},{"url":"https://bugzilla.redhat.com/2230983","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-5194.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5219","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-5219.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38802.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-38802","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230983","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5194.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38802","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5195","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231830","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5195.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5196","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231831","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5196.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231829","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5219.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5457","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5457.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5464","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5464.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5465","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5465.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233709-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213284","tags":["report"]},{"url":"https://bugzilla.suse.com/1213434","tags":["report"]},{"url":"https://bugzilla.suse.com/1214735","tags":["report"]},{"url":"https://bugzilla.suse.com/1214739","tags":["report"]},{"url":"https://bugzilla.suse.com/1215065","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41909","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233762-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233793-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233836-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233839-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244090-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44070","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-38802","tags":["report"]},{"url":"https://kb.cert.org/vuls/id/347067","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6323-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6807-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-26126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-31490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-38406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-38407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-46752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-46753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-47234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-47235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-31948","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-38802","description":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).","status":"published","published":"2023-08-29T00:00:00Z","modified":"2024-10-02T14:46:51.117Z","updated_at":"2026-11-02T14:35:30.116696Z"}],"euvd":[{"id":"EUVD-2023-42575","description":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).","status":"published","published":"2023-08-29T00:00:00Z","modified":"2024-10-02T14:46:51Z","updated_at":"2026-11-03T00:27:58.959241Z"}],"ghsa":[{"id":"GHSA-xh4f-v933-c556","title":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial...","description":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).","status":"published","published":"2023-08-29T18:31:53Z","modified":"2023-11-15T06:30:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:55:02.891904Z"}],"nvd":[{"id":"CVE-2023-38802","description":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).","status":"published","published":"2023-08-29T16:15:09.113Z","modified":"2026-06-17T06:11:08.267Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:08:25.025396Z"}],"osv":[{"id":"AZL-28614","title":"CVE-2023-38802 affecting package frr for versions less than 8.5.3-2","description":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).","status":"published","published":"2023-08-29T16:15:09Z","modified":"2026-04-21T04:25:53.960368Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"DEBIAN-CVE-2023-38802","description":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).","status":"published","published":"2023-08-29T16:15:09.113Z","modified":"2026-10-26T18:03:06.146511522Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"RHSA-2023:5194","title":"Red Hat Security Advisory: frr security update","status":"published","published":"2024-09-16T12:50:46Z","modified":"2025-11-22T12:55:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5195","title":"Red Hat Security Advisory: frr security and bug fix update","status":"published","published":"2024-09-16T12:51:06Z","modified":"2025-11-22T12:55:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5196","title":"Red Hat Security Advisory: frr security and bug fix update","status":"published","published":"2024-09-16T12:50:55Z","modified":"2025-11-22T12:55:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5219","title":"Red Hat Security Advisory: frr security and bug fix update","status":"published","published":"2024-09-16T12:51:16Z","modified":"2025-11-22T12:55:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5457","title":"Red Hat Security Advisory: frr security update","status":"published","published":"2024-09-16T12:51:26Z","modified":"2025-11-22T12:56:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5464","title":"Red Hat Security Advisory: frr security update","status":"published","published":"2024-09-16T12:51:44Z","modified":"2025-11-22T12:56:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5465","title":"Red Hat Security Advisory: frr security update","status":"published","published":"2024-09-16T12:51:35Z","modified":"2025-11-22T12:56:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2023-38802","description":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).","status":"published","published":"2023-08-28T00:00:00Z","modified":"2026-02-05T03:01:58.013083Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"ALSA-2023:5194","title":"Important: frr security update","description":"FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. \n\nSecurity Fix(es):\n\n* frr: Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router (CVE-2023-38802)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-09-18T00:00:00Z","modified":"2026-10-29T11:31:56.30201696Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:5219","title":"Important: frr security and bug fix update","description":"FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. \n\nSecurity Fix(es):\n\n* frr: Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router (CVE-2023-38802)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* BFD crash in FRR running in MetalLB (BZ#2231829)","status":"published","published":"2023-09-19T00:00:00Z","modified":"2026-10-29T11:01:43.906489755Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CVE-2023-38802","description":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).","status":"published","published":"2023-08-29T00:00:00Z","modified":"2026-10-30T02:45:31.39220483Z","updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"DLA-3573-1","title":"frr - security update","status":"published","published":"2023-09-19T00:00:00Z","modified":"2026-03-09T01:20:43.491536Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5495-1","title":"frr - security update","status":"published","published":"2023-09-11T00:00:00Z","modified":"2026-03-09T02:09:58.121347Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:13191-1","title":"frr-8.4-5.1 on GA media","description":"These are all security issues fixed in the frr-8.4-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:21:40.356011Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:3709-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284). \n- CVE-2023-41358: Fixed crash in bgpd/bgp_packet.c (bsc#1214735).\n- CVE-2023-41360: Fixed out-of-bounds read in bgpd/bgp_packet.c (bsc#1214739).\n- CVE-2023-3748: Fixed inifinite loop in babld message parsing may cause DoS (bsc#1213434).\n- CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec (bsc#1215065).\n","status":"published","published":"2023-09-20T16:04:43Z","modified":"2025-05-02T04:35:09.191767Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3762-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2023-38802: Fixed bad length handling when processing BGP attributes. (bsc#1213284)\n- CVE-2023-41358: Fixed a possible crash when processing NLRIs with an attribute length of zero. (bsc#1214735)\n- CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec (bsc#1215065).\n","status":"published","published":"2023-09-25T13:11:31Z","modified":"2026-02-04T02:34:47.441031Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3793-1","title":"Security update for quagga","description":"This update for quagga fixes the following issues:\n\n  - CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284).\n  - CVE-2023-41358: Fixed possible crash when processing NLRIs if the attribute length is zero (bsc#1214735).\n","status":"published","published":"2023-09-26T16:05:40Z","modified":"2025-05-02T04:35:14.558384Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3836-1","title":"Security update for quagga","description":"This update for quagga fixes the following issues:\n\n  - CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284).\n  - CVE-2023-41358: Fixed possible crash when processing NLRIs if the attribute length is zero (bsc#1214735).\n","status":"published","published":"2023-09-27T17:26:28Z","modified":"2026-02-04T04:14:30.090303Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3839-1","title":"Security update for quagga","description":"This update for quagga fixes the following issues:\n\n  - CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284).\n  - CVE-2023-41358: Fixed possible crash when processing NLRIs if the attribute length is zero\n (bsc#1214735).\n","status":"published","published":"2023-09-27T17:34:20Z","modified":"2026-02-04T03:04:11.045142Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2024:4090-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\nUpdate to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:\n\n- CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950,\n  CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234,\n  CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360,\n  CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406,\n  CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes.\n  See https://frrouting.org/release/8.5.6/ for details.\n\nThe most recent frr 8.x series provides several new features,\nimprovements and bug fixes for various protocols and daemons,\nespecially for PIM/PIMv6/BGP and VRF support.\n\nSee https://frrouting.org/release/8.5/ for details and links.\n","status":"published","published":"2024-11-28T07:57:59Z","modified":"2026-02-04T04:12:19.142034Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-6323-1","title":"frr vulnerability","description":"Ben Cartwright-Cox discovered that FRR did not handle RFC 7606\nattributes properly. A remote attacker could possibly use this to\ncause denial of service.\n","status":"published","published":"2023-08-31T01:10:23Z","modified":"2026-02-10T04:43:17Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6807-1","title":"frr vulnerabilities","description":"It was discovered that FRR incorrectly handled certain network traffic.\nA remote attacker could possibly use this issue to cause FRR to crash,\nresulting in a denial of service. (CVE-2022-26126, CVE-2022-26127,\nCVE-2022-26128, CVE-2022-26129, CVE-2022-37032, CVE-2022-37035,\nCVE-2023-31490, CVE-2023-38406, CVE-2023-38407, CVE-2023-46752,\nCVE-2023-46753, CVE-2023-47234, CVE-2023-47235, CVE-2024-31948)\n\nBen Cartwright-Cox discovered that FRR incorrectly handled certain\nnetwork traffic. A remote attacker could possibly use this issue to cause\nFRR to crash, resulting in a denial of service. (CVE-2023-38802)\n","status":"published","published":"2024-06-05T17:19:09Z","modified":"2026-04-27T17:32:34.157755463Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}