CVE-2023-41361 An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in FRRouting FRR Software Two vulnerabilities have been identified in FRRouting (FRR) affecting versions up to 9.0. CVE-2023-41361, published on August 29, 2023, involves a lack of checks for overly large software version lengths in bgpd/bgp_open.c. CVE-2023-46752, published on October 26, 2023, pertains to mishandling malformed MP_REACH_NLRI data, which can lead to a crash. 4 sources 50