Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS13Nnd3LWZtZngtMngyMs0XHg

Misconfigured IP address field in ROA leads to OctoRPKI crash

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.

Patches

For more information

If you have any questions or comments about this advisory email us at [email protected]

Permalink: https://github.com/advisories/GHSA-w6ww-fmfx-2x22
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Nnd3LWZtZngtMngyMs0XHg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 4.2
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H

Identifiers: GHSA-w6ww-fmfx-2x22, CVE-2021-3911
References:

• https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22
• https://nvd.nist.gov/vuln/detail/CVE-2021-3911
• https://www.debian.org/security/2022/dsa-5041
• https://github.com/cloudflare/cfrpki/commit/2882307febd66801de97b2a2ce4d93fe58132005
• https://pkg.go.dev/vuln/GO-2022-0252
• https://github.com/advisories/GHSA-w6ww-fmfx-2x22

Repository: https://github.com/cloudflare/cfrpki
Blast Radius: 0.0

Affected Packages