CVE catalog

CVE-2022-37032

frr: CVE-2022-37032

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.21% · Oct 25, 2026

An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianfrrsid10.7.1-6fixed
Debianfrrforky10.7.1-6fixed
Debianfrrtrixie10.3-3+deb13u1fixed
Debianfrrtrixie-security10.3-3+deb13u1fixed
Debianfrrbookworm8.4.4-1.1~deb12u2fixed
Debianfrrbookworm-security8.4.4-1.1~deb12u2fixed
Ubuntuquagga20.041.2.4-4build1vulnerable
Ubuntuquagga20.041.2.4-4ubuntu0.1vulnerable
Ubuntuquagga20.041.2.4-4ubuntu0.4fixed
Ubuntufrr22.047.5.1-1.1vulnerable
Ubuntufrr22.048.1-1vulnerable
Ubuntufrr22.048.1-1ubuntu1vulnerable
Ubuntufrr22.048.1-1ubuntu1.1vulnerable
Ubuntufrr22.048.1-1ubuntu1.2fixed
Ubuntuquaggapro1.1.1-3vulnerable
Ubuntuquaggapro1.1.1-3ubuntu1vulnerable
Ubuntuquaggapro1.2.2-1vulnerable
Ubuntuquaggapro1.2.2-1ubuntu1vulnerable
Ubuntuquaggapro1.2.4-1vulnerable
Ubuntuquaggapro1.2.4-1ubuntu0.1~esm1vulnerable
Ubuntuquaggapro1.2.4-1ubuntu0.1~esm2vulnerable
Ubuntuquagga20.041.2.4-4build1vulnerable
Ubuntuquagga20.041.2.4-4ubuntu0.1vulnerable
Ubuntuquagga20.041.2.4-4ubuntu0.4fixed
Ubuntufrrpro6.0.2-2build2vulnerable
Ubuntufrrpro7.2-1ubuntu1vulnerable
Ubuntufrrpro7.2-1ubuntu2vulnerable
Ubuntufrrpro7.2.1-1vulnerable
Ubuntufrrpro7.2.1-1ubuntu0.1vulnerable
Ubuntufrrpro7.2.1-1ubuntu0.2vulnerable
Ubuntufrrpro7.2.1-1ubuntu0.2+esm1vulnerable
Ubuntufrrpro7.2.1-1ubuntu0.2+esm2fixed
Ubuntufrr22.047.5.1-1.1vulnerable
Ubuntufrr22.048.1-1vulnerable
Ubuntufrr22.048.1-1ubuntu1vulnerable
Ubuntufrr22.048.1-1ubuntu1.1vulnerable
Ubuntufrr22.048.1-1ubuntu1.2fixed
Susefrrlinux enterprise module for server applications 15 sp37.4-150300.4.7.1fixed
Susefrrlinux enterprise module for server applications 15 sp47.4-150300.4.7.1fixed
Opensusefrrleap 15.37.4-150300.4.7.1fixed
Opensusefrrleap 15.47.4-150300.4.7.1fixed
Opensusefrrtumbleweed8.1-5.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianfrrsourcesid8.4.1-1not yet assignedNot reported[1021016]
Debianfrrsourceforky8.4.1-1not yet assignedNot reported[1021016]
Debianfrrsourcetrixie8.4.1-1not yet assignedNot reported[1021016]
Debianfrrsourcebookworm8.4.1-1not yet assignedNot reported[1021016]
Ubuntuquaggadeb20.041.2.4-4ubuntu0.4Not reportedUSN-6482-1Not reported
Ubuntufrrdeb22.048.1-1ubuntu1.2Not reportedUSN-5685-1Not reported
Ubuntuquaggadeb20.041.2.4-4ubuntu0.4Not reportedUBUNTU-CVE-2022-37032Not reported
Ubuntufrrdebpro7.2.1-1ubuntu0.2+esm2Not reportedUBUNTU-CVE-2022-37032Not reported
Ubuntufrrdeb22.048.1-1ubuntu1.2Not reportedUBUNTU-CVE-2022-37032Not reported
Susefrrrpmlinux enterprise module for server applications 15 sp37.4-150300.4.7.1Not reportedSUSE-SU-2022:3246-1Not reported
Susefrrrpmlinux enterprise module for server applications 15 sp47.4-150300.4.7.1Not reportedSUSE-SU-2022:3246-1Not reported
Opensusefrrrpmleap 15.37.4-150300.4.7.1Not reportedSUSE-SU-2022:3246-1Not reported
Opensusefrrrpmleap 15.47.4-150300.4.7.1Not reportedSUSE-SU-2022:3246-1Not reported
Opensusefrrrpmtumbleweed8.1-5.1Not reportedOPENSUSE-SU-2024:12307-1Not reported

[Debian bug #1021016]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [frr]Unknown
    Details (4)

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

  • [frr-doc]Unknown

    Source package: [frr]

    Details (4)

    • 8.4.4-1.1~deb12u2 · all · bookworm

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · all · bookworm

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

  • [frr-pythontools]Unknown

    Source package: [frr]

    Details (4)

    • 8.4.4-1.1~deb12u2 · all · bookworm

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · all · bookworm

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

  • [frr-rpki-rtrlib]Unknown

    Source package: [frr]

    Details (4)

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

  • [frr-snmp]Unknown

    Source package: [frr]

    Details (4)

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 8.4.1-1

      dsa · frr · debian · bookworm

[openSUSE Tumbleweed]

  • [frr]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 8.1-5.1

      dsa · frr · opensuse · tumbleweed

  • [frr-devel]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1-5.1

      Version impact unknown

      dsa · frr · opensuse · tumbleweed

  • [libfrr0]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1-5.1

      Version impact unknown

      dsa · frr · opensuse · tumbleweed

  • [libfrrcares0]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1-5.1

      Version impact unknown

      dsa · frr · opensuse · tumbleweed

  • [libfrrfpm_pb0]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1-5.1

      Version impact unknown

      dsa · frr · opensuse · tumbleweed

  • [libfrrospfapiclient0]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1-5.1

      Version impact unknown

      dsa · frr · opensuse · tumbleweed

  • [libfrr_pb0]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1-5.1

      Version impact unknown

      dsa · frr · opensuse · tumbleweed

  • [libfrrsnmp0]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1-5.1

      Version impact unknown

      dsa · frr · opensuse · tumbleweed

  • [libfrrzmq0]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1-5.1

      Version impact unknown

      dsa · frr · opensuse · tumbleweed

  • [libmgmt_be_nb0]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1-5.1

      Version impact unknown

      dsa · frr · opensuse · tumbleweed

  • [libmlag_pb0]Unknown

    Source package: [frr]

    Details (1)

    • 10.6.1-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1-5.1

      Version impact unknown

      dsa · frr · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]