FRRouting some new CVEs for <= 9.1

Hello Ben,

Thank you for contacting the Sophos Community.

This is currently being investigated under NC-133407, no further information has been shared.

Regards,

Here is update on these:

These 2 - BGP related - 

CVE-2024-31948 
CVE-2024-31949

are tracked under NC-133407 and are planned to be fixed in upcoming SFOS 20.0MR1 release.

These 2 ( Ospf TE related)
CVE-2024-31950
CVE-2024-31951

These are now tracked under different ticket: NC-133682 and no fix version set for these yet. These CVEs  specific to ospf mpls traffic engineering related - the config for which is not supported on SFOS UI and hence does not directly impact SFOS. (such config is however possible via advanced backend CLIs).

The open source FRRouting does not have any patch for these available. Dev team will continue to monitor open source fix for this and integrate the patch in SFOS when available.