CVE-2019-5892 - CVE House
Back to Database
Status published Medium CVE-2019-5892

bgpd in FRRouting FRR (aka Free Range Routing) 2.x and...

Vulnerability Description

bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux or VyOS), when ENABLE_BGP_VNC is used for Virtual Network Control, allows remote attackers to cause a denial of service (peering session flap) via attribute 255 in a BGP UPDATE packet. This occurred during Disco in January 2019 because FRR does not implement RFC 7606, and therefore the packets with 255 were considered invalid VNC data and the BGP session was closed.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-5892

Credits & Attribution

No credits recorded in the NVD database.

References

More from frrouting

View All →
CVE-2022-43681
An out-of-bounds read exists in the BGP daemon of FRRouting...
Medium 6.5
CVE-2022-40318
An issue was discovered in bgpd in FRRouting (FRR) through...
Medium 6.5
CVE-2022-40302
An issue was discovered in bgpd in FRRouting (FRR) through...
Unknown 0
CVE-2022-37035
An issue was discovered in bgpd in FRRouting (FRR) 8.3....
High 8.1
CVE-2022-37032
An out-of-bounds read in the BGP daemon of FRRouting FRR...
Critical 9.1

Affected Vendor

Affected Software

frrouting
Vulnerable Versions:
2.0, 3.0, 5.0, 6.0, 4.0

Timeline

Official Publish: January 10th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.