CVE-2021-3911: Misconfigured IP address field in ROA leads to OctoRPKI crash in github.com/cloudflare/cfrpki
Summary
CVE-2021-3911: Panic on misconfigured IP address in github.com/cloudflare/cfrpki. Affects github.com/cloudflare/cfrpki versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- cfrpki · Debian:11
The same CVE-2021-3911 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
github.com/cloudflare/cfrpki is a Go package that provides functionality for managing and validating Resource Public Key Infrastructure (RPKI) data. RPKI is a system that allows Internet Service Providers (ISPs) to verify the authenticity and validity of IP address allocations. OctoRPKI is a component of cfrpki that handles the validation and processing of Route Origin Authorizations (ROAs), which are used to specify the valid origin AS for a given IP prefix. ROAs contain an IP address field that specifies the range of IP addresses covered by the authorization.
Vulnerability Detail
The vulnerability occurs when a misconfigured IP address field is present in a ROA returned by a repository. If the IP address field contains too many bits for the IP address, it can cause OctoRPKI to crash. This vulnerability can be exploited by an attacker to disrupt the RPKI validation process and potentially cause denial of service. The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.2.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
go get github.com/cloudflare/cfrpki@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of github.com/cloudflare/cfrpki to mitigate the risk.
Conclusion
In conclusion, the vulnerability CVE-2021-3911 affects the github.com/cloudflare/cfrpki package. It is a moderate severity vulnerability that can lead to a crash in OctoRPKI, potentially causing denial of service. Users should update to version 1.4.0 or later to fix this vulnerability. There are no known workarounds for this issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/cfrpki →
FAQ
This vulnerability can lead to a crash in OctoRPKI, potentially disrupting the RPKI validation process and causing denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using Gopkg.lock to analyze the software without requiring access to the code or installation.
Yes, a fix for this vulnerability is available in version 1.4.0 of github.com/cloudflare/cfrpki. Users should update to this version or later to mitigate the risk.
There are no known workarounds for this vulnerability. It is recommended to update to the latest version of github.com/cloudflare/cfrpki to mitigate the risk.
For more information about this vulnerability, you can email security@cloudflare.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cloudflare/cfrpki.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
