USN-6432-1: Quagga vulnerabilities
17 October 2023
Several security issues were fixed in Quagga.
Releases
Packages
- quagga - BGP/OSPF/RIP routing daemon
Details
It was discovered that the Quagga BGP daemon did not properly check the
attribute length in NRLI. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2023-41358)
It was discovered that the Quagga BGP daemon did not properly manage memory
when reading initial bytes of ORF header. A remote attacker could possibly
use this issue to cause a denial of service. (CVE-2023-41360)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
Ubuntu 18.04
-
quagga
-
1.2.4-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 16.04
-
quagga
-
0.99.24.1-2ubuntu1.4+esm1
Available with Ubuntu Pro
After a standard system update you need to restart Quagga to make
all the necessary changes.
References
Related notices
- USN-6436-1: frr-doc, frr-rpki-rtrlib, frr, frr-pythontools, frr-snmp