frr: CVE-2024-34088

Debian Bug report logs - #1070377
frr: CVE-2024-34088

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: submit@bugs.debian.org

Subject: frr: CVE-2024-34088

Date: Sat, 4 May 2024 18:00:24 +0200

Source: frr
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for frr.

CVE-2024-34088[0]:
| In FRRouting (FRR) through 9.1, it is possible for the get_edge()
| function in ospf_te.c in the OSPF daemon to return a NULL pointer.
| In cases where calling functions do not handle the returned NULL
| value, the OSPF daemon crashes, leading to denial of service.

https://github.com/FRRouting/frr/pull/15674
Introduced by: https://github.com/FRRouting/frr/commit/f173deb35206a09e8dc22828cb08638e289b72a5 (base_8.0)

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-34088
    https://www.cve.org/CVERecord?id=CVE-2024-34088

Please adjust the affected versions in the BTS as needed.

Send a report that this bug log contains spam.