CVE-2022-26126: Buffer Overflow
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isisnbnotifications.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 8.4.4-1.1~deb12u2Fixed in 10.3-3+deb13u1Fixed in 10.7.1-6 - Upgrade
Upgrade
alpine/frrto a version that resolves this vulnerability.Fixed in 8.2.1-r0 - Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 8.4.1-1
Event History
Frequently Asked Questions
What is CVE-2022-26126?
CVE-2022-26126 is a vulnerability in FRRouting through 8.1.0 that allows buffer overflow due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.
What software versions are affected by CVE-2022-26126?
FRRouting versions up to 8.1.0 are affected by CVE-2022-26126.
What is the severity of CVE-2022-26126?
CVE-2022-26126 has a severity level of 7.8 (High).
How can I fix CVE-2022-26126?
To fix CVE-2022-26126, update FRRouting to version 8.4.4-1.1~deb12u1 or later.
Can Fedora users be affected by CVE-2022-26126?
Yes, Fedora users running versions 34, 35, or 36 are also affected by CVE-2022-26126.