From 36d957578d90579e808e47783ea298d6c43cafba Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 4 Aug 2026 18:10:14 -0400 Subject: [PATCH] import Oracle_OSS frr10-10.4.3-3.el9_8.2 --- SOURCES/0017-fix-CVE-2026-37460.patch | 97 +++++++++++++++++++++ SOURCES/0018-set-pythonnouser-env-var.patch | 12 +++ SOURCES/remove-babeld-ldpd.sh | 0 SPECS/frr10.spec | 12 ++- 4 files changed, 120 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0017-fix-CVE-2026-37460.patch create mode 100644 SOURCES/0018-set-pythonnouser-env-var.patch mode change 100644 => 100755 SOURCES/remove-babeld-ldpd.sh diff --git a/SOURCES/0017-fix-CVE-2026-37460.patch b/SOURCES/0017-fix-CVE-2026-37460.patch new file mode 100644 index 0000000..24e89c9 --- /dev/null +++ b/SOURCES/0017-fix-CVE-2026-37460.patch @@ -0,0 +1,97 @@ +From bbb2a8a4c25957b1920f03571c0e43f21fbe9736 Mon Sep 17 00:00:00 2001 +From: Mark Stapp +Date: Wed, 11 Mar 2026 14:52:54 -0400 +Subject: [PATCH] bgpd: improve packet parsing for EVPN and ENCAP/VNC + +Improve packet validation for EVPN NLRIs and for ENCAP/VNC. + +Signed-off-by: Mark Stapp +--- + bgpd/bgp_evpn.c | 17 +++++++++++++++++ + bgpd/bgp_evpn_mh.c | 10 +++++++++- + bgpd/rfapi/rfapi_rib.c | 9 +++++++++ + 3 files changed, 35 insertions(+), 1 deletion(-) + +diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c +index a8fa99fcd..ef9e607ab 100644 +--- a/bgpd/bgp_evpn.c ++++ b/bgpd/bgp_evpn.c +@@ -4984,6 +4984,14 @@ static int process_type2_route(struct peer *peer, afi_t afi, safi_t safi, + goto fail; + } + ++ /* Validate ipaddr_len against the NLRI length */ ++ if ((psize != 33 + (ipaddr_len / 8)) && (psize != 36 + (ipaddr_len / 8))) { ++ flog_err(EC_BGP_EVPN_ROUTE_INVALID, ++ "%u:%s - Rx EVPN Type-2 NLRI with invalid IP address length %d", ++ peer->bgp->vrf_id, peer->host, ipaddr_len); ++ goto fail; ++ } ++ + if (ipaddr_len) { + ipaddr_len /= 8; /* Convert to bytes. */ + p.prefix.macip_addr.ip.ipa_type = (ipaddr_len == IPV4_MAX_BYTELEN) +@@ -5081,6 +5089,15 @@ static int process_type3_route(struct peer *peer, afi_t afi, safi_t safi, + + /* Get the IP. */ + ipaddr_len = *pfx++; ++ ++ /* Validate */ ++ if (psize != 13 + (ipaddr_len / 8)) { ++ flog_err(EC_BGP_EVPN_ROUTE_INVALID, ++ "%u:%s - Rx EVPN Type-3 NLRI with invalid IP address length %d", ++ peer->bgp->vrf_id, peer->host, ipaddr_len); ++ return -1; ++ } ++ + if (ipaddr_len == IPV4_MAX_BITLEN) { + p.prefix.imet_addr.ip.ipa_type = IPADDR_V4; + memcpy(&p.prefix.imet_addr.ip.ip.addr, pfx, IPV4_MAX_BYTELEN); +diff --git a/bgpd/bgp_evpn_mh.c b/bgpd/bgp_evpn_mh.c +index f03678af6..71b2ba0b2 100644 +--- a/bgpd/bgp_evpn_mh.c ++++ b/bgpd/bgp_evpn_mh.c +@@ -752,9 +752,17 @@ int bgp_evpn_type4_route_process(struct peer *peer, afi_t afi, safi_t safi, + memcpy(&esi, pfx, ESI_BYTES); + pfx += ESI_BYTES; + +- + /* Get the IP. */ + ipaddr_len = *pfx++; ++ ++ /* Validate */ ++ if (psize != 19 + (ipaddr_len / 8)) { ++ flog_err(EC_BGP_EVPN_ROUTE_INVALID, ++ "%u:%s - Rx EVPN Type-4 NLRI with invalid IP address length %d", ++ peer->bgp->vrf_id, peer->host, ipaddr_len); ++ return -1; ++ } ++ + if (ipaddr_len == IPV4_MAX_BITLEN) { + memcpy(&vtep_ip, pfx, IPV4_MAX_BYTELEN); + } else { +diff --git a/bgpd/rfapi/rfapi_rib.c b/bgpd/rfapi/rfapi_rib.c +index 9a3d56b06..11384b51c 100644 +--- a/bgpd/rfapi/rfapi_rib.c ++++ b/bgpd/rfapi/rfapi_rib.c +@@ -668,11 +668,20 @@ static void rfapiRibBi2Ri(struct bgp_path_info *bpi, struct rfapi_info *ri, + break; + + case BGP_VNC_SUBTLV_TYPE_RFPOPTION: ++ /* Check for short subtlv: drop */ ++ if (pEncap->length < 3) ++ break; ++ ++ /* Length of zero not valid */ ++ if (pEncap->value[1] == 0) ++ break; ++ + hop = XCALLOC(MTYPE_BGP_TEA_OPTIONS, + sizeof(struct bgp_tea_options)); + assert(hop); + hop->type = pEncap->value[0]; + hop->length = pEncap->value[1]; ++ + hop->value = XCALLOC(MTYPE_BGP_TEA_OPTIONS_VALUE, + pEncap->length - 2); + assert(hop->value); diff --git a/SOURCES/0018-set-pythonnouser-env-var.patch b/SOURCES/0018-set-pythonnouser-env-var.patch new file mode 100644 index 0000000..affbef7 --- /dev/null +++ b/SOURCES/0018-set-pythonnouser-env-var.patch @@ -0,0 +1,12 @@ +diff --git a/tools/frr.service.in b/tools/frr.service.in +index 214eea3..2304d47 100644 +--- a/tools/frr.service.in ++++ b/tools/frr.service.in +@@ -21,6 +21,7 @@ PIDFile=@e_frr_runstatedir@/watchfrr.pid + ExecStart=@e_sbindir@/frrinit.sh start + ExecStop=@e_sbindir@/frrinit.sh stop + ExecReload=@e_sbindir@/frrinit.sh reload ++Environment=PYTHONNOUSERSITE=1 + + [Install] + WantedBy=multi-user.target diff --git a/SOURCES/remove-babeld-ldpd.sh b/SOURCES/remove-babeld-ldpd.sh old mode 100644 new mode 100755 diff --git a/SPECS/frr10.spec b/SPECS/frr10.spec index 854ffb8..89a93de 100644 --- a/SPECS/frr10.spec +++ b/SPECS/frr10.spec @@ -8,7 +8,7 @@ Name: frr10 Version: 10.4.3 -Release: 3%{?checkout}%{?dist} +Release: 3%{?checkout}%{?dist}.2 Summary: Routing daemon License: GPLv2+ URL: http://www.frrouting.org @@ -77,6 +77,9 @@ Patch0014: 0014-isisd-fuzz-test.patch Patch0015: 0015-fix-CVE-2026-37457.patch # https://github.com/FRRouting/frr/commit/693a2e02 Patch0016: 0016-fix-CVE-2026-37459.patch +# https://github.com/FRRouting/frr/commit/7676cad65114aa23adde58 +Patch0017: 0017-fix-CVE-2026-37460.patch +Patch0018: 0018-set-pythonnouser-env-var.patch %description FRRouting is free software that manages TCP/IP based routing protocols. It takes @@ -285,6 +288,13 @@ make check PYTHON=%{__python3} %endif %changelog +* Fri Jul 31 2026 Michal Ruprich - 10.4.3-3.2 +- Resolves: RHEL-222338 - AVC when reading user's site-packages + +* Fri Jul 10 2026 RHEL Packaging Agent - 10.4.3-3.1 +- Fix CVE-2026-37460: improve packet parsing for EVPN and ENCAP/VNC +- Resolves: RHEL-193232 + * Thu May 21 2026 Michal Ruprich - 10.4.3-3 - Resolves: RHEL-174696 - denial of service via crafted BGP UPDATE message