CVE-2022-24798: Internet Routing Registry Daemon (IRRD) Password Hash Disclosure
Summary
CVE-2022-24798: Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. Affects irrd across 3 version ranges.
< 0e41bae8d3d27316381a2fc7b466597230e35ec6
>= 4.2.0, < 4.2.3
< fdffaf8dd71713f06e99dff417e6aa1e6fa84b70
Fixed in fdffaf8dd71713f06e99dff417e6aa1e6fa84b70. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Internet Routing Registry daemon version 4 (IRRD) is a database server that processes IRR objects in the RPSL format. It serves as an authoritative database for IRR objects and allows users to make authorized changes. IRRd instances that serve as mirrors of other IRR databases are not affected by this vulnerability. The vulnerability in IRRd version 4.2.x allowed password hashes to be disclosed in query responses and database exports, potentially enabling unauthorized changes to affected IRR objects.
Vulnerability Detail
The vulnerability in IRRd version 4.2.x allowed password hashes related to mntner objects and database exports to be retrieved by adversaries. By performing a brute-force search for the clear-text passphrase, attackers could gain unauthorized access and make changes to affected IRR objects. This issue only affects instances that process password hashes and serve authoritative databases. The impact of this vulnerability includes potential unauthorized modifications to IRR objects and potential compromise of the IRR system.
How To Fix
Minimum fixed version
fdffaf8dd71713f06e99dff417e6aa1e6fa84b70
This is the first release that contains the fix.
pip install --upgrade "irrd==fdffaf8dd71713f06e99dff417e6aa1e6fa84b70"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to upgrade to the fixed version of IRRd to address the issue.
Conclusion
The vulnerability in IRRd version 4.2.x allowed password hashes to be disclosed, potentially leading to unauthorized changes in IRR objects. Users are strongly advised to upgrade to version 4.2.3 or the main branch to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for irrd →
FAQ
The vulnerability affects IRRd version 4.2.x. Versions in the 4.1.x series were not affected.
No, instances of IRRd that only serve as mirrors of other IRR databases are not affected by this vulnerability.
The vulnerability could allow adversaries to retrieve password hashes and potentially make unauthorized changes to affected IRR objects. It may lead to unauthorized modifications in the IRR system.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is necessary.
To mitigate the risk, it is crucial to upgrade to IRRd version 4.2.3 or the main branch, which fixes the vulnerability and prevents the disclosure of password hashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for irrd.
