Red Hat Enterprise Linux 8 update for frr

Published: 2023-09-19

Risk	Medium
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2023-38802
CWE-ID	CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Red Hat Enterprise Linux for ARM 64 Operating systems & Components / Operating system Red Hat Enterprise Linux for Power, little endian Operating systems & Components / Operating system Red Hat Enterprise Linux for IBM z Systems Operating systems & Components / Operating system Red Hat Enterprise Linux for x86_64 Operating systems & Components / Operating system frr (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Input validation error

EUVDB-ID: #VU80766

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-38802

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing BGP update data with a corrupted attribute 23 (Tunnel Encapsulation). A remote attacker can send specially crafted BGP update data to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for ARM 64: 8

Red Hat Enterprise Linux for Power, little endian: 8

Red Hat Enterprise Linux for IBM z Systems: 8

Red Hat Enterprise Linux for x86_64: 8.0

frr (Red Hat package): before 7.5.1-7.el8_8.2

CPE2.3

cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64:8:*:*:*:*:red_hat_enterprise_linux:*:*

External links

http://access.redhat.com/errata/RHSA-2023:5219

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?