Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-31490: FRR routing daemon BGP service can be crashed remotely
CVE-2023-31490 · published 3 years ago
Summary
The FRR routing software used on Debian can be forced to stop working by a specially crafted network request. This could interrupt your network traffic and affect connectivity. Apply the latest FRR update from Debian or follow the vendor's guidance to patch the problem.
What to do
- Update debian frr to version 8.4.4-1.1~deb12u1.
- Update debian frr to version 8.4.4-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | frr |
< 8.4.4-1.1~deb12u1 Fix: upgrade to 8.4.4-1.1~deb12u1
|
| Debian:13 | debian | frr |
< 8.4.4-1 Fix: upgrade to 8.4.4-1
|
| Debian:14 | debian | frr |
< 8.4.4-1 Fix: upgrade to 8.4.4-1
|
| – | frrouting | frrouting |
8.4.2 cpe:2.3:a:frrouting:frrouting:8.4.2:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 11.0 12.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
37 38 39 cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
Original advisory text
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.
References
- https://security-tracker.debian.org/tracker/CVE-2023-31490 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31490... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-31490 Vendor Advisory
- https://www.debian.org/security/2023/dsa-5495 Vendor Advisory
- https://github.com/FRRouting/frr/issues/13099 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html Third Party Advisory
Severity
7.5
High
Timeline
Published9 May 2023
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta