Security update for frr SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:0901-1 Final 1 1 2022-03-18T11:02:04Z current 2022-03-18T11:02:04Z 2022-03-18T11:02:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for frr This update for frr fixes the following issues: - CVE-2022-26125, CVE-2022-26126: Fixed buffer overflows in unpack_tlv_router_cap() (bsc#1196505, bsc#1196506). - CVE-2022-26127: Fixed heap buffer overflow in babel_packet_examin() (bsc#1196503). - CVE-2022-26128: Fixed buffer overflows in babel_packet_examin() (bsc#1196507). - CVE-2022-26129: Fixed buffer overflows in parse_hello_subtlv(), parse_ihu_subtlv() and parse_update_subtlv() (bsc#1196504). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-901,SUSE-SLE-Module-Server-Applications-15-SP3-2022-901,SUSE-SLE-Module-Server-Applications-15-SP4-2022-901 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20220901-1/ Link for SUSE-SU-2022:0901-1 https://lists.suse.com/pipermail/sle-security-updates/2022-March/010470.html E-Mail link for SUSE-SU-2022:0901-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1180217 SUSE Bug 1180217 https://bugzilla.suse.com/1196503 SUSE Bug 1196503 https://bugzilla.suse.com/1196504 SUSE Bug 1196504 https://bugzilla.suse.com/1196505 SUSE Bug 1196505 https://bugzilla.suse.com/1196506 SUSE Bug 1196506 https://bugzilla.suse.com/1196507 SUSE Bug 1196507 https://www.suse.com/security/cve/CVE-2022-26125/ SUSE CVE CVE-2022-26125 page https://www.suse.com/security/cve/CVE-2022-26126/ SUSE CVE CVE-2022-26126 page https://www.suse.com/security/cve/CVE-2022-26127/ SUSE CVE CVE-2022-26127 page https://www.suse.com/security/cve/CVE-2022-26128/ SUSE CVE CVE-2022-26128 page https://www.suse.com/security/cve/CVE-2022-26129/ SUSE CVE CVE-2022-26129 page SUSE Linux Enterprise Module for Server Applications 15 SP3 frr-7.4-150300.4.3.1 frr-devel-7.4-150300.4.3.1 libfrr0-7.4-150300.4.3.1 libfrr_pb0-7.4-150300.4.3.1 libfrrcares0-7.4-150300.4.3.1 libfrrfpm_pb0-7.4-150300.4.3.1 libfrrgrpc_pb0-7.4-150300.4.3.1 libfrrospfapiclient0-7.4-150300.4.3.1 libfrrsnmp0-7.4-150300.4.3.1 libfrrzmq0-7.4-150300.4.3.1 libmlag_pb0-7.4-150300.4.3.1 frr-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 frr-devel-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libfrr0-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libfrr_pb0-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libfrrcares0-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libfrrfpm_pb0-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libfrrgrpc_pb0-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libfrrospfapiclient0-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libfrrsnmp0-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libfrrzmq0-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libmlag_pb0-7.4-150300.4.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c. CVE-2022-26125 SUSE Linux Enterprise Module for Server Applications 15 SP3:frr-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:frr-devel-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrr0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrr_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrcares0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrfpm_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrgrpc_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrospfapiclient0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrsnmp0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrzmq0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libmlag_pb0-7.4-150300.4.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220901-1/ https://www.suse.com/security/cve/CVE-2022-26125.html CVE-2022-26125 https://bugzilla.suse.com/1196505 SUSE Bug 1196505 Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c. CVE-2022-26126 SUSE Linux Enterprise Module for Server Applications 15 SP3:frr-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:frr-devel-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrr0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrr_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrcares0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrfpm_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrgrpc_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrospfapiclient0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrsnmp0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrzmq0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libmlag_pb0-7.4-150300.4.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220901-1/ https://www.suse.com/security/cve/CVE-2022-26126.html CVE-2022-26126 https://bugzilla.suse.com/1196506 SUSE Bug 1196506 A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c. CVE-2022-26127 SUSE Linux Enterprise Module for Server Applications 15 SP3:frr-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:frr-devel-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrr0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrr_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrcares0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrfpm_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrgrpc_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrospfapiclient0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrsnmp0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrzmq0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libmlag_pb0-7.4-150300.4.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220901-1/ https://www.suse.com/security/cve/CVE-2022-26127.html CVE-2022-26127 https://bugzilla.suse.com/1196503 SUSE Bug 1196503 A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c. CVE-2022-26128 SUSE Linux Enterprise Module for Server Applications 15 SP3:frr-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:frr-devel-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrr0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrr_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrcares0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrfpm_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrgrpc_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrospfapiclient0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrsnmp0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrzmq0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libmlag_pb0-7.4-150300.4.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220901-1/ https://www.suse.com/security/cve/CVE-2022-26128.html CVE-2022-26128 https://bugzilla.suse.com/1196507 SUSE Bug 1196507 Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtlv, parse_ihu_subtlv, and parse_update_subtlv in babeld/message.c. CVE-2022-26129 SUSE Linux Enterprise Module for Server Applications 15 SP3:frr-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:frr-devel-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrr0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrr_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrcares0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrfpm_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrgrpc_pb0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrospfapiclient0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrsnmp0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libfrrzmq0-7.4-150300.4.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libmlag_pb0-7.4-150300.4.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220901-1/ https://www.suse.com/security/cve/CVE-2022-26129.html CVE-2022-26129 https://bugzilla.suse.com/1196504 SUSE Bug 1196504