Ubuntu fixes FRR RPKI regression in USN-7230-3
Original title: USN-7230-3: FRR regression
USN-7230-3 restores RPKI support in FRR after regression introduced by CVE-2024-55553 fix.
Ubuntu Security Notice USN-7230-3 addresses a regression in FRR's RPKI support. The fix for CVE-2024-55553 caused FRR to stop processing RPKI updates after the first one. This prevents route revalidation when RPKI data changes. In Ubuntu 20.04 LTS, the BGP daemon fails to start with RPKI enabled. The update resolves the issue.
- Regression in RPKI support introduced by previous FRR update
- FRR stops processing RPKI updates after first
- Routes not revalidated on RPKI data change
- BGP daemon fails to start in Ubuntu 20.04 LTS with RPKI module
- Original vulnerability CVE-2024-44070 fixed in USN-7230-2
Impact: RPKI update processing failure in FRR
- 1.Upgrade FRR to address RPKI regression
- 2.Check RPKI module status in Ubuntu 20.04 LTS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-44070 | An issue was discovered in FRRouting (FRR) through 10.1 | 7.5 | <1% | ||
| CVE-2024-55553 | In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's… | 7.5 | <1% |
From the original article
USN-7230-2 fixed vulnerabilities in FRR. Unfortunately, the fix for CVE-2024-55553 introduced a regression in RPKI support, causing FRR to stop processing RPKI updates after the first one, so routes were not revalidated when RPKI data changed. In Ubuntu 20.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.