Hide Forgot
The Quagga BGP daemon, bgpd, can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input. The impact is thought to be very low. The bgpd daemon likely will continue running. Warning and debug messages in the logs may contain arbitrary bytes. The issue can only be triggered by a configured peer, if there is sufficient transport security. All versions of quagga are affected.
Acknowledgments: Name: the Quagga project
Created attachment 1392684 [details] Upstream patch
External References: https://www.quagga.net/security/Quagga-2018-1550.txt
Statement: Red Hat Product Security has given this vulnerability a rating of Low. We believe the potential for a crash on supported architectures is very small.
Created quagga tracking bugs for this issue: Affects: fedora-all [bug 1546006]