VDB
Sign up
HIGH8.6

GHSA-7m35-vw2c-696v

GoBGP panics due to a zero value for softwareVersionLen

Quick fix

GHSA-7m35-vw2c-696v — github.com/osrg/gobgp/v3: upgrade to the fixed version with the command below.

go get github.com/osrg/gobgp/v3@v3.35.0

Details

An issue was discovered in GoBGP before 3.35.0 (introduced in v3.11.0). pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/osrg/gobgp/v3
Introduced in: 3.11.0Fixed in: 3.35.0
Fixgo get github.com/osrg/gobgp/v3@v3.35.0

References