CVE-2021-3909: Infinite open connection causes OctoRPKI to hang forever
Summary
CVE-2021-3909: Infinite open connection causes OctoRPKI to hang forever. Affects github.com/cloudflare/cfrpki versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- cfrpki · Debian:11
The same CVE-2021-3909 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OctoRPKI is a Go package that provides a command-line tool for managing RPKI repositories. It is used to send HTTP requests to a repository and retrieve responses. OctoRPKI allows users to interact with RPKI data and perform various operations. However, a vulnerability in OctoRPKI allows for an infinite open connection, which can be exploited for a slowloris DOS attack. This vulnerability can cause OctoRPKI to hang indefinitely, impacting its availability and performance.
Vulnerability Detail
The vulnerability in OctoRPKI arises from the lack of connection length limitation. When OctoRPKI sends an HTTP request to a repository, the repository keeps the connection open for a day before responding. However, it continues to drip feed new bytes to keep the connection alive. This allows an attacker to initiate a slowloris DOS attack, where multiple connections are opened and kept alive, exhausting OctoRPKI's resources and causing it to hang indefinitely. The impact of this vulnerability is a denial of service, as OctoRPKI becomes unresponsive and unable to process legitimate requests.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
go get github.com/cloudflare/cfrpki@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to update to the patched version as soon as possible.
Conclusion
The vulnerability in OctoRPKI allows for an infinite open connection, which can be exploited for a slowloris DOS attack. To mitigate this vulnerability, users should update to version 1.4.0 of the 'github.com/cloudflare/cfrpki/cmd/octorpki' package. This update includes a patch that limits the length of connections and prevents the slowloris DOS attack. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/cfrpki →
FAQ
OctoRPKI is a Go package used for managing RPKI repositories and interacting with RPKI data.
A slowloris DOS attack is a type of denial of service attack where the attacker opens multiple connections to a target server and keeps them alive by sending partial requests. This exhausts the server's resources and causes it to become unresponsive.
The impact of this vulnerability is a denial of service, as OctoRPKI becomes unresponsive and unable to process legitimate requests.
To fix this vulnerability, users should update to version 1.4.0 of the 'github.com/cloudflare/cfrpki/cmd/octorpki' package.
There is no specific workaround mentioned for this vulnerability. Users are advised to update to the patched version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cloudflare/cfrpki.
