CVE-2023-38283

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-38283", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-10-02T14:55:43.156Z", "dateReserved": "2023-07-14T00:00:00.000Z", "datePublished": "2023-08-29T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-08-29T15:24:54.279Z"}, "descriptions": [{"lang": "en", "value": "In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig"}, {"url": "https://github.com/openbgpd-portable/openbgpd-portable/releases/tag/8.1"}, {"url": "https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling"}, {"url": "https://news.ycombinator.com/item?id=37305800"}, {"url": "https://www.openbsd.org/errata73.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:39:12.596Z"}, "title": "CVE Program Container", "references": [{"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig", "tags": ["x_transferred"]}, {"url": "https://github.com/openbgpd-portable/openbgpd-portable/releases/tag/8.1", "tags": ["x_transferred"]}, {"url": "https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling", "tags": ["x_transferred"]}, {"url": "https://news.ycombinator.com/item?id=37305800", "tags": ["x_transferred"]}, {"url": "https://www.openbsd.org/errata73.html", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "bgp", "product": "openbgpd", "cpes": ["cpe:2.3:a:bgp:openbgpd:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "8.1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-02T14:52:46.910912Z", "id": "CVE-2023-38283", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T14:55:43.156Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig", "tags": ["x_transferred"]}, {"url": "https://github.com/openbgpd-portable/openbgpd-portable/releases/tag/8.1", "tags": ["x_transferred"]}, {"url": "https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling", "tags": ["x_transferred"]}, {"url": "https://news.ycombinator.com/item?id=37305800", "tags": ["x_transferred"]}, {"url": "https://www.openbsd.org/errata73.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:39:12.596Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-38283", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-02T14:52:46.910912Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:bgp:openbgpd:*:*:*:*:*:*:*:*"], "vendor": "bgp", "product": "openbgpd", "versions": [{"status": "affected", "version": "0", "lessThan": "8.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T14:55:38.203Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig"}, {"url": "https://github.com/openbgpd-portable/openbgpd-portable/releases/tag/8.1"}, {"url": "https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling"}, {"url": "https://news.ycombinator.com/item?id=37305800"}, {"url": "https://www.openbsd.org/errata73.html"}], "descriptions": [{"lang": "en", "value": "In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-08-29T15:24:54.279568"}}}, "cveMetadata": {"cveId": "CVE-2023-38283", "state": "PUBLISHED", "dateUpdated": "2024-10-02T14:55:43.156Z", "dateReserved": "2023-07-14T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-08-29T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}, {"affectedData": [{"cpes": ["cpe:2.3:a:bgp:openbgpd:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "openbgpd", "vendor": "bgp", "versions": [{"lessThan": "8.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openbgpd:openbgpd:*:*:*:*:*:*:*:*", "matchCriteriaId": "E100F828-9002-4B76-902C-49345579AAA7", "versionEndExcluding": "8.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*", "matchCriteriaId": "131B4208-6843-40D3-8818-159D1204BD0E", "versionEndExcluding": "7.3", "vulnerable": false}, {"criteria": "cpe:2.3:o:openbsd:openbsd:7.3:-:*:*:*:*:*:*", "matchCriteriaId": "7BAA0C9B-7CEA-4647-809F-027EB34C142E", "vulnerable": false}, {"criteria": "cpe:2.3:o:openbsd:openbsd:7.3:errata_001:*:*:*:*:*:*", "matchCriteriaId": "B3CC37B8-46C0-407B-8DE4-2B5BC36BA969", "vulnerable": false}, {"criteria": "cpe:2.3:o:openbsd:openbsd:7.3:errata_002:*:*:*:*:*:*", "matchCriteriaId": "D53FE3CA-1A90-4783-8AC2-C0B4CF6F052D", "vulnerable": false}, {"criteria": "cpe:2.3:o:openbsd:openbsd:7.3:errata_003:*:*:*:*:*:*", "matchCriteriaId": "9C32DD2B-BBE0-4031-B105-743E4058B4A1", "vulnerable": false}, {"criteria": "cpe:2.3:o:openbsd:openbsd:7.3:errata_004:*:*:*:*:*:*", "matchCriteriaId": "3F481F84-81C2-4E5F-BD60-4C46CD3DD603", "vulnerable": false}, {"criteria": "cpe:2.3:o:openbsd:openbsd:7.3:errata_005:*:*:*:*:*:*", "matchCriteriaId": "DCAE527B-1176-4759-B903-59A72245517B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006."}, {"lang": "es", "value": "En OpenBGPD anterior a 8.1, un manejo incorrecto de los datos de actualizaci\u00f3n de BGP (longitud de los atributos de ruta) establecidos por un actor remoto potencialmente distante puede hacer que el sistema reinicie incorrectamente una sesi\u00f3n. Esto se corrige en la errata 006 de OpenBSD 7.3."}], "id": "CVE-2023-38283", "lastModified": "2026-11-10T12:10:00.177", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-38283", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-02T14:52:46.910912Z", "version": "2.0.3"}}]}, "published": "2023-08-29T16:15:08.960", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/openbgpd-portable/openbgpd-portable/releases/tag/8.1"}, {"source": "cve@mitre.org", "tags": ["Mailing List"], "url": "https://news.ycombinator.com/item?id=37305800"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://www.openbsd.org/errata73.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/openbgpd-portable/openbgpd-portable/releases/tag/8.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://news.ycombinator.com/item?id=37305800"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://www.openbsd.org/errata73.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}