Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2023-46565: Gobgp Remote Denial of Service via Handling Error
CVE-2023-46565 · published 2 years ago
Summary
Gobgp, an open-source BGP speaker, has a vulnerability that could allow a remote attacker to crash the service, causing a denial of service. This affects systems running gobgp that receive malicious BGP messages. To protect your system, consider updating gobgp to the latest version.
What to do
- Update canonical gobgp to version 2.12.0-1ubuntu0.1~esm2.
- Update canonical gobgp to version 2.25.0-3ubuntu0.1+esm2.
- Update debian gobgp to version 4.3.0-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | osrg | <= 3.20.0 |
| Ubuntu:Pro:18.04:LTS | canonical | gobgp | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | gobgp |
< 2.12.0-1ubuntu0.1~esm2 Fix: upgrade to 2.12.0-1ubuntu0.1~esm2
|
| Ubuntu:Pro:22.04:LTS | canonical | gobgp |
< 2.25.0-3ubuntu0.1+esm2 Fix: upgrade to 2.25.0-3ubuntu0.1+esm2
|
| Debian:11 | debian | gobgp | All versions |
| Debian:12 | debian | gobgp | All versions |
| Debian:13 | debian | gobgp | All versions |
| Debian:14 | debian | gobgp |
< 4.3.0-1 Fix: upgrade to 4.3.0-1
|
Original advisory text
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-46565
- https://github.com/osrg/gobgp/issues/2725
- https://github.com/osrg/gobgp/commit/419c50dfac578daa4d11256904d0dc182f1a9b22
- https://github.com/advisories/GHSA-6rqv-5cg7-m4x3
- https://ubuntu.com/security/CVE-2023-46565 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-46565 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-46565 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7661-1 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-120Classic Buffer Overflow
Timeline
Published29 Apr 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-6rqv-5cg7-m4x3 · GHSA
CVE-2023-46565 · NVD
UBUNTU-CVE-2023-46565 · OSV
DEBIAN-CVE-2023-46565 · OSV
Track software like this
Free during beta