CVE-2020-12831

Name	CVE-2020-12831
Description	An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
frr (PTS)	buster, buster (lts)	7.5.1-1.1+deb10u3	vulnerable
	buster (security)	7.5.1-1.1+deb10u2	vulnerable
	bullseye	7.5.1-1.1+deb11u2	vulnerable
	bullseye (security)	7.5.1-1.1+deb11u3	vulnerable
	bookworm (security), bookworm	8.4.4-1.1~deb12u1	vulnerable
	trixie	10.1.1-0.1	vulnerable
	sid	10.2-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
frr	source	(unstable)	(unfixed)	unimportant

https://github.com/FRRouting/frr/pull/6383
https://github.com/FRRouting/frr/commit/7734484a378052a513c9e21165c13bf85f78ad48