An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Frrouting | Frrouting | * | 10.1 (including) |
| Frr | Ubuntu | devel | * |
| Frr | Ubuntu | esm-apps/focal | * |
| Frr | Ubuntu | focal | * |
| Frr | Ubuntu | jammy | * |
| Frr | Ubuntu | noble | * |
| Frr | Ubuntu | oracular | * |
| Frr | Ubuntu | plucky | * |
| Frr | Ubuntu | upstream | * |
| Quagga | Ubuntu | esm-infra/bionic | * |
| Quagga | Ubuntu | esm-infra/focal | * |
| Quagga | Ubuntu | focal | * |
| Quagga | Ubuntu | upstream | * |