CVE-2023-38802

moderate-risk

Published 2023-08-29

FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).

Do I need to act?

0.94% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (8)

Frrouting

Picos

Debian Linux

Fedora

Affected Vendors

Debian Fedoraproject Frrouting Pica8

References (14)

Exploit https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling

Mailing List https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://news.ycombinator.com/item?id=37305800

Third Party Advisory https://www.debian.org/security/2023/dsa-5495

Exploit https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling

Mailing List https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://news.ycombinator.com/item?id=37305800

Third Party Advisory https://www.debian.org/security/2023/dsa-5495

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 3/34 · Minimal

Exposure 14/34 · Moderate