Bug 1211249 (CVE-2023-31490) - VUL-0: CVE-2023-31490: frr: remote denial of service via the bgp_attr_psid_sub() function
Summary: VUL-0: CVE-2023-31490: frr: remote denial of service via the bgp_attr_psid_su...
Status: RESOLVED FIXED
Alias: CVE-2023-31490
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/365734/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-31490:6.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-05-10 05:39 UTC by Alexander Bergmann
Modified: 2024-04-18 07:45 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
bgpd: Ensure stream received has enough data (5.30 KB, patch)
2023-05-15 08:20 UTC, Marius Tomaschewski 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2023-05-10 05:39:55 UTC 
CVE-2023-31490

An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a
denial of service via the bgp_attr_psid_sub() function.

Upstream commit:
https://github.com/FRRouting/frr/pull/12454/commits/06431bfa7570f169637ebb5898f0b0cc3b010802

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-31490
https://www.cve.org/CVERecord?id=CVE-2023-31490
https://github.com/FRRouting/frr/issues/13099
Comment 9 Maintenance Automation 2023-06-15 08:30:04 UTC 
SUSE-SU-2023:2518-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1211248, 1211249
CVE References: CVE-2023-31489, CVE-2023-31490
Sources used:
openSUSE Leap 15.5 (src): frr-8.4-150500.4.3.1
Server Applications Module 15-SP5 (src): frr-8.4-150500.4.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Marius Tomaschewski 2023-06-26 08:47:26 UTC 
Setting assignee (back to) security team.
Comment 11 Marcus Meissner 2024-04-18 07:45:06 UTC 
close