critique
CVE-2025-43973
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go ...
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Photon OS. Plus basse selon GHSA (moyenne), Ubuntu (moyenne).
Description
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 4.0 | gobgp | 2.20.0-27.ph4 |
| Photon OS 5.0 | gobgp | 3.1.0-19.ph5 |
| chainguard | cilium-1.16, cilium-fips-1.16 | 1.16.9-r1 et 1 autres |
| debian 11 | gobgp | pas de correctif indiqué |
| debian 12 | gobgp | pas de correctif indiqué |
| debian 13 | gobgp | 3.35.0-1 |
| debian 14 | gobgp | 3.35.0-1 |
| echo | gobgp | 3.35.0-1 |
| go::GitHub Security Advisory Go | github.com/osrg/gobgp, github.com/osrg/gobgp/v3 | 3.35.0 |
| minimos | cilium-1.16, cilium-fips-1.16 | 1.16.17-r0 |
| rapidfort debian 12 | gobgp | 0:3.35.0-1 |
| rapidfort debian 13 | gobgp | 0:3.35.0-1 |
Afficher les 19 entrées de 16 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 4.0 | gobgp | 2.20.0-27.ph4 |
| Photon OS 5.0 | gobgp | 3.1.0-19.ph5 |
| chainguard | cilium-1.16 | 1.16.9-r1 |
| chainguard | cilium-fips-1.16 | 1.16.9-r2 |
| debian 11 | gobgp | pas de correctif indiqué |
| debian 12 | gobgp | pas de correctif indiqué |
| debian 13 | gobgp | 3.35.0-1 |
| debian 14 | gobgp | 3.35.0-1 |
| echo | gobgp | 3.35.0-1 |
| go::GitHub Security Advisory Go | github.com/osrg/gobgp | pas de correctif indiqué |
| go::GitHub Security Advisory Go | github.com/osrg/gobgp/v3 | 3.35.0 |
| minimos | cilium-1.16 | 1.16.17-r0 |
| minimos | cilium-fips-1.16 | 1.16.17-r0 |
| rapidfort debian 12 | gobgp | 0:3.35.0-1 |
| rapidfort debian 13 | gobgp | 0:3.35.0-1 |
| ubuntu 18.04-ESM | gobgp | 1.29-1ubuntu0.1+esm1 |
| ubuntu 20.04-ESM | gobgp | 2.12.0-1ubuntu0.1~esm2 |
| ubuntu 22.04 | gobgp | pas de correctif indiqué |
| ubuntu 24.04 | gobgp | pas de correctif indiqué |
Références
- https://github.com/osrg/gobgp
- https://github.com/osrg/gobgp/commit/5693c58a4815cc6327b8d3b6980f0e5aced28abe
- https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-43973
- https://ubuntu.com/security/notices/USN-7661-1
- https://www.cve.org/CVERecord?id=CVE-2025-43973