Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lldpd: fix CVE-2023-41910 and CVE-2021-43612 for kirkstone (CVE-Score 9.8 and 7.5) #815

Open
wants to merge 3 commits into
base: kirkstone
Choose a base branch
from

Commits on Apr 25, 2024

  1. lldpd: fix CVE-2023-41910 for kirkstone

    Apply changes to match fix of lldpd/lldpd@a9aeabd
    
    More information about issue:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-41910
    
    Suggested-by: Vincent Bernat (vincent@bernat.ch)
    Signed-off-by: Georg Gebauer <georg.gebauer@zeiss.com>
    GeorgGebauer-CZ committed Apr 25, 2024
    Configuration menu
    Copy the full SHA
    cecb7c4 View commit details
    Browse the repository at this point in the history

Commits on Apr 26, 2024

  1. lldpd: Fix CVE-2021-43612 heap overflow when reading SONMP packages

    By sending short SONMP packets, an attacker can make the decoder crash
    by reading too much data on the heap. SONMP packets are fixed in size,
    just ensure we get the enough bytes to contain a SONMP packet.
    
    References:
    * lldpd/lldpd@73d4268
    * https://nvd.nist.gov/vuln/detail/CVE-2021-43612
    
    Suggested-by: Vincent Bernat (vincent@bernat.ch)
    CVE: CVE-2021-43612
    
    Signed-off-by: Georg Gebauer <georg.gebauer@zeiss.com>
    GeorgGebauer-CZ committed Apr 26, 2024
    Configuration menu
    Copy the full SHA
    5e1dec4 View commit details
    Browse the repository at this point in the history

Commits on Apr 30, 2024

  1. Configuration menu
    Copy the full SHA
    a5c7fb1 View commit details
    Browse the repository at this point in the history