frr: Security fix CVE-2022-36440 / CVE-2022-40302

Add a security fix from the stable/8.2 branch for two CVEs for the same
vulneratiblity:

CVE-2022-36440:
A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the
peek_for_as4_capability function. Attackers can maliciously construct
BGP open packets and send them to BGP peers running frr-bgpd, resulting
in DoS.

CVE-2022-40302:
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By
crafting a BGP OPEN message with an option of type 0xff (Extended Length
from RFC 9072), attackers may cause a denial of service (assertion
failure and daemon restart, or out-of-bounds read). This is possible
because of inconsistent boundary checks that do not account for reading
3 bytes (instead of 2) in this 0xff case.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-36440
https://nvd.nist.gov/vuln/detail/CVE-2022-40302
https://cyberriskleaders.com/new-vulnerabilities-disclosed-in-frrouting-software/
https://github.com/FRRouting/frr/issues/13202

Patch from:
https://github.com/FRRouting/frr/commit/02a0e45f66160f571196a105b217e1bb84d1a835

Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>

0 files changed, 0 insertions, 0 deletions