crítica
CVE-2025-43973
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según GHSA (media), Ubuntu (media).
Descripción
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 4.0 | gobgp | 2.20.0-27.ph4 |
| Photon OS 5.0 | gobgp | 3.1.0-19.ph5 |
| chainguard | cilium-1.16, cilium-fips-1.16 | 1.16.9-r1 y 1 más |
| debian 11 | gobgp | sin corrección indicada |
| debian 12 | gobgp | sin corrección indicada |
| debian 13 | gobgp | 3.35.0-1 |
| debian 14 | gobgp | 3.35.0-1 |
| echo | gobgp | 3.35.0-1 |
| go::GitHub Security Advisory Go | github.com/osrg/gobgp, github.com/osrg/gobgp/v3 | 3.35.0 |
| minimos | cilium-1.16, cilium-fips-1.16 | 1.16.17-r0 |
| rapidfort debian 12 | gobgp | 0:3.35.0-1 |
| rapidfort debian 13 | gobgp | 0:3.35.0-1 |
Mostrar las 19 entradas de 16 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 4.0 | gobgp | 2.20.0-27.ph4 |
| Photon OS 5.0 | gobgp | 3.1.0-19.ph5 |
| chainguard | cilium-1.16 | 1.16.9-r1 |
| chainguard | cilium-fips-1.16 | 1.16.9-r2 |
| debian 11 | gobgp | sin corrección indicada |
| debian 12 | gobgp | sin corrección indicada |
| debian 13 | gobgp | 3.35.0-1 |
| debian 14 | gobgp | 3.35.0-1 |
| echo | gobgp | 3.35.0-1 |
| go::GitHub Security Advisory Go | github.com/osrg/gobgp | sin corrección indicada |
| go::GitHub Security Advisory Go | github.com/osrg/gobgp/v3 | 3.35.0 |
| minimos | cilium-1.16 | 1.16.17-r0 |
| minimos | cilium-fips-1.16 | 1.16.17-r0 |
| rapidfort debian 12 | gobgp | 0:3.35.0-1 |
| rapidfort debian 13 | gobgp | 0:3.35.0-1 |
| ubuntu 18.04-ESM | gobgp | 1.29-1ubuntu0.1+esm1 |
| ubuntu 20.04-ESM | gobgp | 2.12.0-1ubuntu0.1~esm2 |
| ubuntu 22.04 | gobgp | sin corrección indicada |
| ubuntu 24.04 | gobgp | sin corrección indicada |
Referencias
- https://github.com/osrg/gobgp
- https://github.com/osrg/gobgp/commit/5693c58a4815cc6327b8d3b6980f0e5aced28abe
- https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-43973
- https://ubuntu.com/security/notices/USN-7661-1
- https://www.cve.org/CVERecord?id=CVE-2025-43973