{"id":"CVE-2023-41360","aliases":["ALSA-2024:2156","AZL-28617","CLSA-2023-1697816189","CLSA-2023-1697816288","CLSA-2023-1697817200","CLSA-2023-1697817694","DEBIAN-CVE-2023-41360","DLA-3573-1","EUVD-2023-45863","GHSA-8x46-qpq3-2pgp","RHSA-2024:2156","SUSE-SU-2023:3709-1","SUSE-SU-2024:4090-1","UBUNTU-CVE-2023-41360","USN-6432-1","USN-6436-1","openSUSE-SU-2024:13191-1"],"status":"published","title":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte...","description":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01153,"percentile":0.67397,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2023-08-29T00:00:00Z","modified":"2026-10-30T02:45:18Z","fixes":[{"ecosystem":"Azure Linux:2","package":"frr","fixed_in":["8.5.3-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"frr","fixed_in":["8.4.4-1.1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"frr","fixed_in":["8.4.4-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"frr","fixed_in":["8.4.4-1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"quagga","fixed_in":["0.99.24.1-2ubuntu1.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"quagga","fixed_in":["1.2.4-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"quagga","fixed_in":["1.2.4-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","fixed_in":["7.2.1-1ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"frr","fixed_in":["8.1-1ubuntu1.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:2","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.3-2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-bgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-isisd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ospf6d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ospfd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-pimd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ripd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ripngd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.24.1-2ubuntu1.4+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"quagga-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.24.1-2ubuntu1.4+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"quagga-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"quagga-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.0.2.el6.tuxcare.ol.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"quagga-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.0.2.el6.tuxcare.ol.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"quagga-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.0.2.el6.tuxcare.ol.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1~deb12u1"}]}],"versions":["8.4.2-1","8.4.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-1.1+deb10u1"}]}],"versions":["6.0.2-2","6.0.2-2+deb10u1","6.0.2-2+deb10u2","7.2-1","7.2.1-1","7.3.1-1","7.4-1","7.4-1.1","7.4-2","7.5-1","7.5.1-1","7.5.1-1.1"],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.24.1-2ubuntu1.4+esm1"}]}],"versions":["0.99.24.1-2","0.99.24.1-2ubuntu1","0.99.24.1-2ubuntu1.1","0.99.24.1-2ubuntu1.2","0.99.24.1-2ubuntu1.3","0.99.24.1-2ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.1~esm1"}]}],"versions":["1.1.1-3","1.1.1-3ubuntu1","1.2.2-1","1.2.2-1ubuntu1","1.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-4ubuntu0.1"}]}],"versions":["1.2.4-4build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm1"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.6"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.24.1-2ubuntu1.4+esm1"}]}],"versions":["0.99.24.1-2","0.99.24.1-2ubuntu1","0.99.24.1-2ubuntu1.1","0.99.24.1-2ubuntu1.2","0.99.24.1-2ubuntu1.3","0.99.24.1-2ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.1~esm1"}]}],"versions":["1.1.1-3","1.1.1-3ubuntu1","1.2.2-1","1.2.2-1ubuntu1","1.2.4-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-4ubuntu0.1"}]}],"versions":["1.2.4-4build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm1"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.6"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-5.1"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"frrouting","product":"frrouting"}],"references":[{"url":"https://github.com/FRRouting/frr/pull/14245","tags":["x_transferred","Patch","Vendor Advisory","fix","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/","tags":["vendor-advisory","x_transferred","Mailing List","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/","tags":["vendor-advisory","x_transferred","Mailing List","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4/","tags":["vendor-advisory","x_transferred","Mailing List","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41360","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4"},{"url":"https://github.com/advisories/GHSA-8x46-qpq3-2pgp"},{"url":"https://access.redhat.com/errata/RHSA-2024:2156","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-31489","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-31490","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41358","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41359","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41360","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41909","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46752","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46753","tags":["report"]},{"url":"https://bugzilla.redhat.com/2235839","tags":["report"]},{"url":"https://bugzilla.redhat.com/2235840","tags":["report"]},{"url":"https://bugzilla.redhat.com/2235842","tags":["report"]},{"url":"https://bugzilla.redhat.com/2237416","tags":["report"]},{"url":"https://bugzilla.redhat.com/2238990","tags":["report"]},{"url":"https://bugzilla.redhat.com/2238992","tags":["report"]},{"url":"https://bugzilla.redhat.com/2246379","tags":["report"]},{"url":"https://bugzilla.redhat.com/2246381","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2156.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18_04-els/CLSA-2023-1697816189","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1697816288","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2023-1697817200.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2023-1697817694.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41360.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-41360","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246381","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-11664","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-15291","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2156.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31489","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31489","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31490","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31490","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41358","tags":["advisory"]},{"url":"https://github.com/FRRouting/frr/pull/14260","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41359","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41359","tags":["advisory"]},{"url":"https://github.com/FRRouting/frr/pull/14232","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41360","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41909","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46752","tags":["advisory"]},{"url":"https://github.com/FRRouting/frr/pull/14645/commits/b08afc81c60607a4f736f418f2e3eb06087f1a35","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46753","tags":["advisory"]},{"url":"https://github.com/FRRouting/frr/pull/14645/commits/d8482bf011cb2b173e85b65b4bf3d5061250cdb9","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233709-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213284","tags":["report"]},{"url":"https://bugzilla.suse.com/1213434","tags":["report"]},{"url":"https://bugzilla.suse.com/1214735","tags":["report"]},{"url":"https://bugzilla.suse.com/1214739","tags":["report"]},{"url":"https://bugzilla.suse.com/1215065","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41909","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244090-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44070","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-41360","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6432-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6436-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-41358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-41909","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-41360","description":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2024-10-15T18:32:41.794Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:19.217111Z"}],"euvd":[{"id":"EUVD-2023-45863","description":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2024-10-15T18:32:41Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T00:27:36.689661Z"}],"ghsa":[{"id":"GHSA-8x46-qpq3-2pgp","title":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte...","description":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.","status":"published","published":"2023-08-29T06:30:14Z","modified":"2024-10-16T21:32:11Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:58:31.969274Z"}],"nvd":[{"id":"CVE-2023-41360","description":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.","status":"published","published":"2023-08-29T04:15:16.957Z","modified":"2026-06-17T06:21:58.22Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:08:25.025396Z"}],"osv":[{"id":"AZL-28617","title":"CVE-2023-41360 affecting package frr for versions less than 8.5.3-2","description":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.","status":"published","published":"2023-08-29T04:15:16Z","modified":"2026-04-21T04:25:54.266133Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"CVE-2023-41360","description":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2026-10-30T02:45:18.787516989Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-41360","description":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.","status":"published","published":"2023-08-29T04:15:16.957Z","modified":"2026-10-26T18:02:32.61026193Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"RHSA-2024:2156","title":"Red Hat Security Advisory: frr security update","status":"published","published":"2024-09-16T14:56:13Z","modified":"2026-03-18T11:33:18.12979Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-41360","description":"An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.","status":"published","published":"2023-08-29T04:15:00Z","modified":"2026-02-04T02:58:27.407206Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:2156","title":"Moderate: frr security update","description":"FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. \n\nSecurity Fix(es):\n\n* frr: incorrect length check in bgp_capability_llgr() can lead do DoS (CVE-2023-31489)\n* frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)\n* frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)\n* frr: out of bounds read in bgp_attr_aigp_valid (CVE-2023-41359)\n* frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)\n* frr: mishandled malformed data leading to a crash (CVE-2023-46752)\n* frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)\n* frr: ahead-of-stream read of ORF header (CVE-2023-41360)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:42.652585922Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2023-1697816189","title":"Fix CVE(s): CVE-2023-41360, CVE-2023-41358","description":"\n   * SECURITY UPDATE: bgpd/bgp_packet.c can read the initial byte of the\n     ORF header in an ahead-of-stream situation\n     - debian/patches/CVE-2023-41360.patch: don't read the first byte of\n       ORF header if we are ahead of stream.\n     - CVE-2023-41360\n   * SECURITY UPDATE: bgpd/bgp_packet.c processes NLRIs if the attribute\n     length is zero\n     - debian/patches/CVE-2023-41358.patch: do not process NLRIs if the\n       attribute length is zero\n     - CVE-2023-41358","status":"published","published":"2023-10-20T15:36:33Z","modified":"2026-06-04T10:04:06.351365626Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697816288","title":"Fix CVE(s): CVE-2023-41358, CVE-2023-41360","description":"\n   * SECURITY UPDATE: bgpd/bgp_packet.c can read the initial byte of the\n     ORF header in an ahead-of-stream situation\n     - debian/patches/CVE-2023-41360.patch: don't read the first byte of\n       ORF header if we are ahead of stream.\n     - CVE-2023-41360\n   * SECURITY UPDATE: bgpd/bgp_packet.c processes NLRIs if the attribute\n     length is zero\n     - debian/patches/CVE-2023-41358.patch: do not process NLRIs if the\n       attribute length is zero\n     - CVE-2023-41358\n   * Fix documentation pdf generation","status":"published","published":"2023-10-20T15:38:13Z","modified":"2026-06-04T10:04:15.743897Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697817200","title":"quagga: Fix of 2 CVEs","description":"- CVE-2023-41360: don't read the first byte of ORF header if we are ahead of\n  stream\n- CVE-2023-41358: do not process NLRIs if the attribute length is zero","status":"published","published":"2023-10-20T15:53:24Z","modified":"2026-10-21T10:47:46.773784137Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697817694","title":"quagga: Fix of 2 CVEs","description":"- CVE-2023-41360: don't read the first byte of ORF header if we are ahead of\n  stream\n- CVE-2023-41358: do not process NLRIs if the attribute length is zero","status":"published","published":"2023-10-20T16:01:38Z","modified":"2026-10-21T10:48:11.539118654Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"DLA-3573-1","title":"frr - security update","status":"published","published":"2023-09-19T00:00:00Z","modified":"2026-03-09T01:20:43.491536Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"openSUSE-SU-2024:13191-1","title":"frr-8.4-5.1 on GA media","description":"These are all security issues fixed in the frr-8.4-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:21:40.356011Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:3709-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284). \n- CVE-2023-41358: Fixed crash in bgpd/bgp_packet.c (bsc#1214735).\n- CVE-2023-41360: Fixed out-of-bounds read in bgpd/bgp_packet.c (bsc#1214739).\n- CVE-2023-3748: Fixed inifinite loop in babld message parsing may cause DoS (bsc#1213434).\n- CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec (bsc#1215065).\n","status":"published","published":"2023-09-20T16:04:43Z","modified":"2025-05-02T04:35:09.191767Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2024:4090-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\nUpdate to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:\n\n- CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950,\n  CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234,\n  CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360,\n  CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406,\n  CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes.\n  See https://frrouting.org/release/8.5.6/ for details.\n\nThe most recent frr 8.x series provides several new features,\nimprovements and bug fixes for various protocols and daemons,\nespecially for PIM/PIMv6/BGP and VRF support.\n\nSee https://frrouting.org/release/8.5/ for details and links.\n","status":"published","published":"2024-11-28T07:57:59Z","modified":"2026-02-04T04:12:19.142034Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-6432-1","title":"quagga vulnerabilities","description":"It was discovered that the Quagga BGP daemon did not properly check the\nattribute length in NRLI. A remote attacker could possibly use this issue\nto cause a denial of service. (CVE-2023-41358)\n\nIt was discovered that the Quagga BGP daemon did not properly manage memory\nwhen reading initial bytes of ORF header. A remote attacker could possibly\nuse this issue to cause a denial of service. (CVE-2023-41360)\n","status":"published","published":"2023-10-17T10:25:58Z","modified":"2026-06-25T13:30:22.638491778Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6436-1","title":"frr vulnerabilities","description":"It was discovered that the FRR did not properly check the attribute length\nin NRLI. A remote attacker could possibly use this issue to cause a denial\nof service. (CVE-2023-41358)\n\nIt was discovered that the FRR did not properly manage memory when reading\ninitial bytes of ORF header. A remote attacker could possibly use this\nissue to cause a denial of service. (CVE-2023-41360)\n\nIt was discovered that FRR did not properly validate the attributes in the\nBGP FlowSpec functionality. A remote attacker could possibly use this issue\nto cause a denial of service. (CVE-2023-41909)\n","status":"published","published":"2023-10-18T04:43:51Z","modified":"2026-02-10T04:43:22Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}