CVE-2021-3912: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Background

The package under scrutiny is github.com/cloudflare/cfrpki, which is part of the Go ecosystem. This package provides functionality for handling Certificate Authority (CA) Resource Public Key Infrastructure (RPKI) data. It includes the HTTPFetcher.GetXML function, which is responsible for fetching XML data from a remote server. The vulnerability in this package allows for resource exhaustion through the use of a GZIP bomb. By sending a response of unlimited size, an attacker can consume excessive memory resources, leading to denial of service (DoS) conditions.

Vulnerability Detail

The vulnerability (CVE-2021-3912) arises from the HTTPFetcher.GetXML function's ability to read a response of unlimited size into memory. This unrestricted behavior allows an attacker to send a GZIP bomb, which is a compressed file that expands to an enormous size when decompressed. As a result, the system's memory resources can be exhausted, leading to a DoS situation. This vulnerability can be exploited remotely by an attacker with network access to the affected system. The impact of this vulnerability can range from temporary unavailability of the affected service to a complete system crash.

go get github.com/cloudflare/cfrpki@v1.5.10

go get github.com/cloudflare/cfrpki@v1.4.0

Workaround

As a workaround, developers can manually limit the size of the response being read by modifying the code in the HTTPFetcher.GetXML function. Here is an example of how the code can be modified:

def GetXML(url string) ([]byte, error) {
  // Set a maximum response size
  maxResponseSize := 10 * 1024 * 1024 // 10MB

  // Make the HTTP request
  resp, err := http.Get(url)
  if err != nil {
    return nil, err
  }

  // Read the response
  body, err := ioutil.ReadAll(io.LimitReader(resp.Body, maxResponseSize))
  if err != nil {
    return nil, err
  }

  // Close the response body
  resp.Body.Close()

  return body, nil
}

Conclusion

In conclusion, the github.com/cloudflare/cfrpki package is vulnerable to a resource exhaustion vulnerability (CVE-2021-3912) that can be exploited through the use of a GZIP bomb. This vulnerability can lead to denial of service (DoS) conditions, impacting the availability of the affected service. It is recommended to update the package to version 1.4.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/cloudflare/cfrpki →

FAQ