PT-2025-17427 · Gobgp+4 · Gobgp+4

Published 2025-04-20 · Updated 2025-08-08 · CVE-2025-43973

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoBGP versions prior to 3.35.0

Description An issue was discovered where the input length for an RTR message is not properly verified, potentially leading to issues when not all bytes are available for the message. This affects the pkg/packet/rtr/rtr.go file.

Recommendations For versions prior to 3.35.0, update to version 3.35.0 or later to resolve the issue. As a temporary workaround, consider implementing input length verification for RTR messages in the rtr.go file until a patch is available.

Fix

Weakness Enumeration

CWE-193

Related Identifiers

BDU:2025-09850

CVE-2025-43973

GHSA-C5JG-WR5V-2WP2

GO-2025-3633

OPENSUSE-SU-2025:15017-1

USN-7661-1

Affected Products

Debian

Gobgp

Linuxmint

Red Os

Ubuntu

References · 54

• https://github.com/osrg/gobgp/commit/5693c58a4815cc6327b8d3b6980f0e5aced28abe · Patch
• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0 · Patch
• https://ubuntu.com/security/CVE-2025-43973 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-43973 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7661-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43970 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c5jg-wr5v-2wp2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43972 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7661-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15017-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43973 · Security Note
• https://osv.dev/vulnerability/GO-2025-3633 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-43973 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43971 · Vendor Advisory