Security update for frr SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0901-1 Final 1 1 2022-03-18T11:02:05Z current 2022-03-18T11:02:05Z 2022-03-18T11:02:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for frr This update for frr fixes the following issues: - CVE-2022-26125, CVE-2022-26126: Fixed buffer overflows in unpack_tlv_router_cap() (bsc#1196505, bsc#1196506). - CVE-2022-26127: Fixed heap buffer overflow in babel_packet_examin() (bsc#1196503). - CVE-2022-26128: Fixed buffer overflows in babel_packet_examin() (bsc#1196507). - CVE-2022-26129: Fixed buffer overflows in parse_hello_subtlv(), parse_ihu_subtlv() and parse_update_subtlv() (bsc#1196504). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2022-901,openSUSE-SLE-15.4-2022-901 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IMU2X5TQEN42TVGMLEB32I5WD3N5Z2FU/ E-Mail link for openSUSE-SU-2022:0901-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1180217 SUSE Bug 1180217 https://bugzilla.suse.com/1196503 SUSE Bug 1196503 https://bugzilla.suse.com/1196504 SUSE Bug 1196504 https://bugzilla.suse.com/1196505 SUSE Bug 1196505 https://bugzilla.suse.com/1196506 SUSE Bug 1196506 https://bugzilla.suse.com/1196507 SUSE Bug 1196507 https://www.suse.com/security/cve/CVE-2022-26125/ SUSE CVE CVE-2022-26125 page https://www.suse.com/security/cve/CVE-2022-26126/ SUSE CVE CVE-2022-26126 page https://www.suse.com/security/cve/CVE-2022-26127/ SUSE CVE CVE-2022-26127 page https://www.suse.com/security/cve/CVE-2022-26128/ SUSE CVE CVE-2022-26128 page https://www.suse.com/security/cve/CVE-2022-26129/ SUSE CVE CVE-2022-26129 page openSUSE Leap 15.3 frr-7.4-150300.4.3.1 frr-devel-7.4-150300.4.3.1 libfrr0-7.4-150300.4.3.1 libfrr_pb0-7.4-150300.4.3.1 libfrrcares0-7.4-150300.4.3.1 libfrrfpm_pb0-7.4-150300.4.3.1 libfrrgrpc_pb0-7.4-150300.4.3.1 libfrrospfapiclient0-7.4-150300.4.3.1 libfrrsnmp0-7.4-150300.4.3.1 libfrrzmq0-7.4-150300.4.3.1 libmlag_pb0-7.4-150300.4.3.1 frr-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 frr-devel-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 libfrr0-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 libfrr_pb0-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 libfrrcares0-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 libfrrfpm_pb0-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 libfrrgrpc_pb0-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 libfrrospfapiclient0-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 libfrrsnmp0-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 libfrrzmq0-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 libmlag_pb0-7.4-150300.4.3.1 as a component of openSUSE Leap 15.3 Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c. CVE-2022-26125 openSUSE Leap 15.3:frr-7.4-150300.4.3.1 openSUSE Leap 15.3:frr-devel-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrr0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrr_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrcares0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrfpm_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrgrpc_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrospfapiclient0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrsnmp0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrzmq0-7.4-150300.4.3.1 openSUSE Leap 15.3:libmlag_pb0-7.4-150300.4.3.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IMU2X5TQEN42TVGMLEB32I5WD3N5Z2FU/ https://www.suse.com/security/cve/CVE-2022-26125.html CVE-2022-26125 https://bugzilla.suse.com/1196505 SUSE Bug 1196505 Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c. CVE-2022-26126 openSUSE Leap 15.3:frr-7.4-150300.4.3.1 openSUSE Leap 15.3:frr-devel-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrr0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrr_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrcares0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrfpm_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrgrpc_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrospfapiclient0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrsnmp0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrzmq0-7.4-150300.4.3.1 openSUSE Leap 15.3:libmlag_pb0-7.4-150300.4.3.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IMU2X5TQEN42TVGMLEB32I5WD3N5Z2FU/ https://www.suse.com/security/cve/CVE-2022-26126.html CVE-2022-26126 https://bugzilla.suse.com/1196506 SUSE Bug 1196506 A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c. CVE-2022-26127 openSUSE Leap 15.3:frr-7.4-150300.4.3.1 openSUSE Leap 15.3:frr-devel-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrr0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrr_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrcares0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrfpm_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrgrpc_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrospfapiclient0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrsnmp0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrzmq0-7.4-150300.4.3.1 openSUSE Leap 15.3:libmlag_pb0-7.4-150300.4.3.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IMU2X5TQEN42TVGMLEB32I5WD3N5Z2FU/ https://www.suse.com/security/cve/CVE-2022-26127.html CVE-2022-26127 https://bugzilla.suse.com/1196503 SUSE Bug 1196503 A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c. CVE-2022-26128 openSUSE Leap 15.3:frr-7.4-150300.4.3.1 openSUSE Leap 15.3:frr-devel-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrr0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrr_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrcares0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrfpm_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrgrpc_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrospfapiclient0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrsnmp0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrzmq0-7.4-150300.4.3.1 openSUSE Leap 15.3:libmlag_pb0-7.4-150300.4.3.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IMU2X5TQEN42TVGMLEB32I5WD3N5Z2FU/ https://www.suse.com/security/cve/CVE-2022-26128.html CVE-2022-26128 https://bugzilla.suse.com/1196507 SUSE Bug 1196507 Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtlv, parse_ihu_subtlv, and parse_update_subtlv in babeld/message.c. CVE-2022-26129 openSUSE Leap 15.3:frr-7.4-150300.4.3.1 openSUSE Leap 15.3:frr-devel-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrr0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrr_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrcares0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrfpm_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrgrpc_pb0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrospfapiclient0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrsnmp0-7.4-150300.4.3.1 openSUSE Leap 15.3:libfrrzmq0-7.4-150300.4.3.1 openSUSE Leap 15.3:libmlag_pb0-7.4-150300.4.3.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IMU2X5TQEN42TVGMLEB32I5WD3N5Z2FU/ https://www.suse.com/security/cve/CVE-2022-26129.html CVE-2022-26129 https://bugzilla.suse.com/1196504 SUSE Bug 1196504