PT-2023-26344 · Openbsd+1 · Openbgpd+1

Greyface-On · Published 2023-08-29 · Updated 2023-09-07 · CVE-2023-38283

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenBGPD versions prior to 8.1

Description The issue arises from incorrect handling of BGP update data, specifically the length of path attributes, which can be set by a potentially distant remote actor. This may cause the system to incorrectly reset a session.

Recommendations For OpenBGPD versions prior to 8.1, update to OpenBSD 7.3 errata 006 to resolve the issue.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2023-38283

Affected Products

Debian

Openbgpd

References · 18

• 🔥 https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-38283 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-38283 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38283 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-38283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38283 · Security Note
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig · Patch
• https://ubuntu.com/security/CVE-2023-38283 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-38283 · Vendor Advisory
• https://github.com/openbgpd-portable/openbgpd-portable/releases/tag/8.1 · Note
• https://t.me/cibsecurity/69359 · Telegram Post
• https://openbsd.org/errata73.html · Note
• https://news.ycombinator.com/item?id=37305800 · Note
• https://twitter.com/fletch_ai/status/1698865282184261954 · Twitter Post
• https://t.me/cvenotify/57745 · Telegram Post