CVE-2023-38802 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 76%

Affected Products (NVD)

Vendor	Product	Version
frrouting	frrouting	7.5.1 ≤ 𝑥 ≤ 9.0
pica8	picos	4.3.3.2
debian	debian_linux	10.0
debian	debian_linux	11.0
debian	debian_linux	12.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

frr

bookworm	8.4.4-1.1~deb12u1 fixed
bookworm (security)	8.4.4-1.1~deb12u1 fixed
bullseye	7.5.1-1.1+deb11u2 fixed
bullseye (security)	7.5.1-1.1+deb11u3 fixed
sid	10.2.1-1 fixed
trixie	10.2.1-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

frr

bionic	dne
focal	Fixed 7.2.1-1ubuntu0.2+esm2 released
jammy	Fixed 8.1-1ubuntu1.5 released
lunar	Fixed 8.4.2-1ubuntu1.3 released
mantic	not-affected
noble	not-affected
oracular	not-affected
trusty	dne
xenial	dne

quagga

bionic	not-affected
focal	not-affected
jammy	dne
lunar	dne
mantic	dne
noble	dne
oracular	dne
trusty	ignored
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

frr

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise sap 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise sap 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise sap 15 SP7	10.2.1-150700.1.7 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise server 15 SP7	10.2.1-150700.1.7 fixed

frr-devel

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise sap 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise sap 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise sap 15 SP7	10.2.1-150700.1.7 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise server 15 SP7	10.2.1-150700.1.7 fixed

libfpm_pb0

suse enterprise sap 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP6	1.1.1-150400.12.5.1 fixed
suse enterprise server 12 SP3	1.1.1-17.10.1 fixed
suse enterprise server 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP3	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP6	1.1.1-150400.12.5.1 fixed

libfrr0

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise sap 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise sap 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise sap 15 SP7	10.2.1-150700.1.7 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise server 15 SP7	10.2.1-150700.1.7 fixed

libfrr_pb0

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise sap 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise sap 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise sap 15 SP7	10.2.1-150700.1.7 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise server 15 SP7	10.2.1-150700.1.7 fixed

libfrrcares0

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise sap 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise sap 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise sap 15 SP7	10.2.1-150700.1.7 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise server 15 SP7	10.2.1-150700.1.7 fixed

libfrrfpm_pb0

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise sap 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise sap 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise sap 15 SP7	10.2.1-150700.1.7 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise server 15 SP7	10.2.1-150700.1.7 fixed

libfrrgrpc_pb0

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed

libfrrospfapiclient0

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise sap 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise sap 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise sap 15 SP7	10.2.1-150700.1.7 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise server 15 SP7	10.2.1-150700.1.7 fixed

libfrrsnmp0

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise sap 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise sap 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise sap 15 SP7	10.2.1-150700.1.7 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise server 15 SP7	10.2.1-150700.1.7 fixed

libfrrzmq0

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise sap 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise sap 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise sap 15 SP7	10.2.1-150700.1.7 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise server 15 SP7	10.2.1-150700.1.7 fixed

libmgmt_be_nb0

suse enterprise sap 15 SP7	10.2.1-150700.1.7 fixed
suse enterprise server 15 SP7	10.2.1-150700.1.7 fixed

libmlag_pb0

suse enterprise sap 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise sap 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise sap 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise sap 15 SP7	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP3	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP4	7.4-150300.4.17.1 fixed
suse enterprise server 15 SP5	8.5.6-150500.4.30.1 fixed
suse enterprise server 15 SP6	8.4-150500.4.8.1 fixed
suse enterprise server 15 SP7	8.5.6-150500.4.30.1 fixed

libospf0

suse enterprise sap 12 SP5	1.1.1-17.10.1 fixed
suse enterprise sap 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP6	1.1.1-150400.12.5.1 fixed
suse enterprise server 12 SP3	1.1.1-17.10.1 fixed
suse enterprise server 12 SP5	1.1.1-17.10.1 fixed
suse enterprise server 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP3	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP6	1.1.1-150400.12.5.1 fixed

libospfapiclient0

suse enterprise sap 12 SP5	1.1.1-17.10.1 fixed
suse enterprise sap 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP6	1.1.1-150400.12.5.1 fixed
suse enterprise server 12 SP3	1.1.1-17.10.1 fixed
suse enterprise server 12 SP5	1.1.1-17.10.1 fixed
suse enterprise server 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP3	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP6	1.1.1-150400.12.5.1 fixed

libquagga_pb0

suse enterprise sap 12 SP5	1.1.1-17.10.1 fixed
suse enterprise sap 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP6	1.1.1-150400.12.5.1 fixed
suse enterprise server 12 SP3	1.1.1-17.10.1 fixed
suse enterprise server 12 SP5	1.1.1-17.10.1 fixed
suse enterprise server 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP3	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP6	1.1.1-150400.12.5.1 fixed

libzebra1

suse enterprise sap 12 SP5	1.1.1-17.10.1 fixed
suse enterprise sap 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP6	1.1.1-150400.12.5.1 fixed
suse enterprise server 12 SP3	1.1.1-17.10.1 fixed
suse enterprise server 12 SP5	1.1.1-17.10.1 fixed
suse enterprise server 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP3	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP6	1.1.1-150400.12.5.1 fixed

quagga

suse enterprise sap 12 SP5	1.1.1-17.10.1 fixed
suse enterprise sap 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP6	1.1.1-150400.12.5.1 fixed
suse enterprise server 12 SP3	1.1.1-17.10.1 fixed
suse enterprise server 12 SP5	1.1.1-17.10.1 fixed
suse enterprise server 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP3	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP6	1.1.1-150400.12.5.1 fixed

quagga-devel

suse enterprise sap 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise sap 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise sap 15 SP6	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP1	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP2	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP3	1.1.1-150000.4.3.1 fixed
suse enterprise server 15 SP4	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP5	1.1.1-150400.12.5.1 fixed
suse enterprise server 15 SP6	1.1.1-150400.12.5.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

frr

RHEL 8	0:7.5.1-7.el8_8.2 fixed
RHEL 8.1 E4S	0:7.0-5.el8_1.1 fixed
RHEL 8.2 AUS	0:7.0-5.el8_2.1 fixed
RHEL 8.2 E4S	0:7.0-5.el8_2.1 fixed
RHEL 8.2 TUS	0:7.0-5.el8_2.1 fixed
RHEL 8.8 AUS	0:7.5.1-7.el8_8.2 fixed
RHEL 8.8 E4S	0:7.5.1-7.el8_8.2 fixed
RHEL 8.8 EUS	0:7.5.1-7.el8_8.2 fixed
RHEL 8.8 TUS	0:7.5.1-7.el8_8.2 fixed
RHEL 9	0:8.3.1-5.el9_2.2 fixed

frr-contrib

RHEL 8.1 E4S	0:7.0-5.el8_1.1 fixed
RHEL 8.2 AUS	0:7.0-5.el8_2.1 fixed
RHEL 8.2 E4S	0:7.0-5.el8_2.1 fixed
RHEL 8.2 TUS	0:7.0-5.el8_2.1 fixed

frr-selinux

RHEL 8	0:7.5.1-7.el8_8.2 fixed
RHEL 8.8 AUS	0:7.5.1-7.el8_8.2 fixed
RHEL 8.8 E4S	0:7.5.1-7.el8_8.2 fixed
RHEL 8.8 EUS	0:7.5.1-7.el8_8.2 fixed
RHEL 8.8 TUS	0:7.5.1-7.el8_8.2 fixed
RHEL 9	0:8.3.1-5.el9_2.2 fixed

Known Exploits!

Common Weakness Enumeration

CWE-354 - Improper Validation of Integrity Check Value
The software does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

References

https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling

https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4/

https://news.ycombinator.com/item?id=37305800