PT-2025-17424 · Gobgp+4 · Gobgp+4

Published 2025-04-20 · Updated 2025-08-08 · CVE-2025-43970

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions GoBGP versions prior to 3.35.0

Description The issue arises from improper input length checking in the pkg/packet/mrt/mrt.go file, specifically failing to ensure the presence of 12 bytes or 36 bytes depending on the address family.

Recommendations For versions prior to 3.35.0, update to version 3.35.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

BDU:2025-09853

CVE-2025-43970

GHSA-HQHQ-HP5X-XP3W

GO-2025-3630

OPENSUSE-SU-2025:15017-1

USN-7661-1

Affected Products

Debian

Gobgp

Linuxmint

Red Os

Ubuntu

References · 56

• https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0 · Patch
• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0 · Patch
• https://ubuntu.com/security/CVE-2025-43973 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7661-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43970 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-43970 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43972 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3630 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hqhq-hp5x-xp3w · Vendor Advisory
• https://osv.dev/vulnerability/USN-7661-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15017-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46565 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-43970 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43970 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43971 · Vendor Advisory