cloudflare/cfrpki · Security
Misconfigured IP address field in ROA leads to OctoRPKI crash
- GHSA ID
- GHSA-w6ww-fmfx-2x22
- CVE ID
- CVE-2021-3911
- Severity
- medium
- Published
- Updated
- CVSS
- 4.2 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
- CVSS v3
- 4.2 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
Description
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
Patches
For more information
If you have any questions or comments about this advisory email us at [email protected]
CWEs
- CWE-20 · Improper Input Validation
- CWE-252 · Unchecked Return Value
References
- https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2021-3911 ↗
- https://www.debian.org/security/2022/dsa-5041 ↗
- https://github.com/cloudflare/cfrpki/commit/2882307febd66801de97b2a2ce4d93fe58132005 ↗
- https://pkg.go.dev/vuln/GO-2022-0252 ↗
- https://github.com/advisories/GHSA-w6ww-fmfx-2x22 ↗