An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).
References
| Link | Resource |
|---|---|
| https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0 | Patch |
| https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0 | Patch Release Notes |
Configurations
History
08 May 2025, 15:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Osrg
Osrg gobgp |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| References | () https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0 - Patch, Release Notes | |
| References | () https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0 - Patch | |
| CWE | CWE-1284 | |
| CPE | cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:* |
21 Apr 2025, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-21 01:15
Updated : 2025-05-08 15:45
NVD link : CVE-2025-43970
Mitre link : CVE-2025-43970
JSON object : View
Products Affected
osrg
- gobgp
CWE
CWE-1284
Improper Validation of Specified Quantity in Input