cloudflare/cfrpki · Security
Infinite certificate chain depth results in OctoRPKI running forever
- GHSA ID
- GHSA-g5gj-9ggf-9vmq
- CVE ID
- CVE-2021-3908
- Severity
- medium
- Published
- Updated
- CVSS
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
OctoRPKI (github.com/cloudflare/cfrpki/cmd/octorpki) does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.
For more information
If you have any questions or comments about this advisory email us at [email protected]
CWEs
- CWE-400 · Uncontrolled Resource Consumption
- CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')