CVE-2023-38283 Denial of service in n/a
A remote attacker can cause a denial of service by sending malformed BGP update data, requiring a patch to OpenBGPD.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38283?
CVE-2023-38283 is a medium-severity denial of service vulnerability in n/a, published on 29 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
Weakness: CWE-754
Which versions are affected by CVE-2023-38283?
It affects 1 product.
Products include Openbgpd Openbgpd.
How do I fix CVE-2023-38283?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-38283 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38283 exists.
Sources
Also known as DEBIAN-CVE-2023-38283, GHSA-q32v-3jr9-xvmc, UBUNTU-CVE-2023-38283.