← Back to CVE Index
CVE-2023-47234
Disclosed 2023-11-03
Description
An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes).
Severity & CVSS Score
7.5
HIGH
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected FRR Versions
- < 8.5.4
- 9.0.0 ~ 9.0.1
Versions prior to 8.4 are end-of-life and no longer receive security updates.
References
| URL | Source |
|---|---|
| https://github.com/FRRouting/frr/commit/c37119df45bbf4ef713bc10475af2ee06e12f3bf | GitHub |
Git Fixes
- c37119df45bbf4ef713bc10475af2ee06e12f3bf
- 250844bbcabcc55d9cc009c0769718a4f2a1e166
- c25bdf085532f6ca636a927a8fe4352bd570df9d
- a0c4ec2f52b299d45a77b0fcb29452329d22dce1
- b21e7b8fe8c4970f2f6f794cb78bcc93057af94f
Raw Data
- CVE-2023-47234.cve.json — CVE record (JSON)
- CVE-2023-47234.frr.json — FRR-specific data (JSON)