Donika Mirdita

**Name of the Vulnerable Software and Affected Versions** NLnet Labs' bcder library versions 0.7.2 and earlier **Description** The bcder library panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding. **Recommendations** For versions 0.7.2 and earlier, update to version 0.7.3 or later, which fixes the issue by more thoroughly checking inputs and returning errors as expected. As a temporary workaround, consider implementing additional input validation to prevent the library from panicking when encountering invalid data.

**Name of the Vulnerable Software and Affected Versions** Routinator versions up to and including 0.12.1 **Description** The issue is caused by insufficient input checking in the bcder library, which may lead to a crash when trying to parse certain malformed RPKI objects. **Recommendations** For versions up to and including 0.12.1, update to a version that includes the fix for the insufficient input checking in the bcder library to prevent crashes when parsing malformed RPKI objects. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Routinator versions 0.9.0 through 0.12.1 **Description** The issue concerns a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature of Routinator. This feature allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for an attacker to craft a URL that results in the response being stored outside of the directory specified for it. **Recommendations** For Routinator versions 0.9.0 through 0.12.1, consider disabling the keep-rrdp-responses feature until a patch is available to prevent potential path traversal attacks. Restrict access to the directory where responses are stored to minimize the risk of exploitation. Avoid using the keep-rrdp-responses feature with untrusted RRDP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do software vulnerável e versões afetadas** NLnet Labs Routinator, versões 0.9.0 a 0.11.2 **Descrição** O problema decorre de um erro no tratamento de erros, em que dados nos arquivos de snapshot e delta do RRDP que não estão corretamente codificados em base 64 são tratados como um erro fatal, fazendo com que o Routinator seja encerrado. Isso pode levar a uma negação de serviço para os dados RPKI que o Routinator fornece aos roteadores, impedindo potencialmente que as redes validem as origens das rotas com base nos dados RPKI. No entanto, esse problema não permite que um invasor manipule os dados RPKI. **Recomendações** Para as versões 0.9.0 a 0.11.2 do NLnet Labs Routinator, considere atualizar para uma versão em que este problema de tratamento de erros esteja corrigido, pois a versão atual pode fazer com que o Routinator seja encerrado devido a dados codificados incorretamente em base 64 nos arquivos RRDP. No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.