Vulnerability Description
FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Frrouting | Frrouting | >= 7.5.1, <= 9.0 |
| Pica8 | Picos | 4.3.3.2 |
| Debian | Debian Linux | 10.0 |
| Fedoraproject | Fedora | 37 |
Related Weaknesses (CWE)
References
- https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handlingExploitTechnical DescriptionThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00020.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing List
- https://news.ycombinator.com/item?id=37305800Third Party Advisory
- https://www.debian.org/security/2023/dsa-5495Third Party Advisory
- https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handlingExploitTechnical DescriptionThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00020.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing List
- https://news.ycombinator.com/item?id=37305800Third Party Advisory
- https://www.debian.org/security/2023/dsa-5495Third Party Advisory
FAQ
What is CVE-2023-38802?
CVE-2023-38802 is a vulnerability with a CVSS score of 7.5 (HIGH). FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).
How severe is CVE-2023-38802?
CVE-2023-38802 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-38802?
Check the references section above for vendor advisories and patch information. Affected products include: Frrouting Frrouting, Pica8 Picos, Debian Debian Linux, Fedoraproject Fedora.