提出 #780189: osrg GoBGP 4.3.0 Improper Input Validation情報

タイトルosrg GoBGP 4.3.0 Improper Input Validation
説明A vulnerability was found in osrg GoBGP version 4.3.0. It affects the BGPHeader.DecodeFromBytes function in the pkg/packet/bgp/bgp.go file. The vulnerability is classified as improper input validation because the parser does not validate the 16-byte BGP Marker field. According to RFC 4271, all 16 bytes of the Marker field must be set to 0xFF. However, the current implementation only reads the Length and Type fields from offsets 16 and 18, and does not verify bytes 0-15 at all. As a result, BGP messages with arbitrary Marker values are incorrectly accepted instead of being rejected as malformed. This violates protocol standards and may reduce resilience against malformed or injected traffic on an established TCP session.
ソース⚠️ https://github.com/osrg/gobgp/commit/f0f24a2a901cbf159260698211ab15c583ced131
ユーザー
 Sunxj (UID 96442)
送信2026年03月14日 13:00 (23 日 ago)
モデレーション2026年03月30日 09:50 (16 days later)
ステータス承諾済み
VulDBエントリ354156 [osrg GoBGP 迄 4.3.0 BGP Header pkg/packet/bgp/bgp.go BGPHeader.DecodeFromBytes 特権昇格]
ポイント20

Do you know our Splunk app?

Download it now for free!