Bug 900214 (CVE-2021-26928) – <net-misc/bird-2.0.8 does not provide functionality for password authentication of BGP peers

• Product: Gentoo Security
• Status: RESOLVED INVALID

[Description Petr Vaněk 2023-03-07 20:14:21 UTC]

CVE-2021-26928:

BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which may, for example, include Tigera products in some configurations, as well as products of other vendors) may have been susceptible to route redirection for Denial of Service and/or Information Disclosure. NOTE: a researcher has asserted that the behavior is within Tigera’s area of responsibility; however, Tigera disagrees.

[Comment 1 Alexander Zubkov 2023-03-09 11:16:23 UTC]

This is nonsence. Somebody involved in this CVE did not do their homework properly. BIRD supports TCP MD5 auth for BGP since ~14 years ago:
https://gitlab.nic.cz/labs/bird/-/commit/d51aa2819005a03e4cfb6f62333be6ccadfb3c06

[Comment 2 Petr Vaněk 2023-03-09 11:32:40 UTC]

Yes, it does not seem to be correct, se also this thread https://bird.network.cz/pipermail/bird-users/2023-March/016761.html it appeared in the list today.

[Comment 3 John Helmert III 2023-03-11 04:42:22 UTC]

Petr: Is there a fix in bird-2.0.8? Or is the CVE invalid? We don't have to track it here if it's bogus.

[Comment 4 Petr Vaněk 2023-03-11 07:55:22 UTC]

It is bogus. Upstream will submit a request to reject this CVE [1].

[1] http://trubka.network.cz/pipermail/bird-users/2023-March/016766.html

[Comment 5 Petr Vaněk 2023-03-23 09:14:50 UTC]

The CVE is DISPUTED by upstream which claims that the functionality was added in 1.0.12 [1].

[1] http://trubka.network.cz/pipermail/bird-users/2023-March/016763.html