CVE-2021-3908: Infinite certificate chain depth in OctoRPKI
Summary
CVE-2021-3908: Infinite certificate chain depth results in OctoRPKI running forever. Affects github.com/cloudflare/cfrpki versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- cfrpki · Debian:11
The same CVE-2021-3908 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OctoRPKI is a Go package that provides a command-line tool for managing Resource Public Key Infrastructure (RPKI) data. RPKI is a system used to secure the Internet's routing infrastructure by associating IP address prefixes with digital certificates. OctoRPKI allows users to create and manage RPKI repositories, certificates, and related data. It is widely used by organizations to ensure the integrity and security of their routing information.
Vulnerability Detail
The vulnerability in OctoRPKI allows for the creation of an infinite certificate chain depth. This means that a Certificate Authority (CA) can create child certificates in an ad-hoc manner, resulting in a never-ending tree traversal. As a result, OctoRPKI can run indefinitely, consuming system resources and potentially leading to denial of service. This vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
go get github.com/cloudflare/cfrpki@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version as soon as possible.
Conclusion
In conclusion, the CVE-2021-3908 vulnerability in OctoRPKI allows for the creation of an infinite certificate chain depth, potentially leading to denial of service. It is recommended to update to version 1.4.0 or later of the affected package to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/cfrpki →
FAQ
OctoRPKI is a Go package used for managing Resource Public Key Infrastructure (RPKI) data. It allows users to create and manage RPKI repositories, certificates, and related data.
The vulnerability allows for the creation of an infinite certificate chain depth, leading to a never-ending tree traversal. This can result in OctoRPKI running indefinitely, consuming system resources and potentially causing denial of service.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
To fix this vulnerability, update to version 1.4.0 or later of the github.com/cloudflare/cfrpki/cmd/octorpki package.
No, there is no known workaround for this vulnerability. It is crucial to update to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cloudflare/cfrpki.
