PT-2023-16047 · Nlnet · Nlnet Labs Krill

Kittensaredabest · Publicado 2023-01-17 · Atualizado 2023-01-25 · CVE-2023-0158

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NLnet Labs Krill versions prior to 0.12.1

Description The issue arises when a direct query is made for any existing directory under the "/rrdp/" endpoint, rather than an RRDP file, causing the server to crash. If the built-in "/rrdp" endpoint is exposed directly to the internet, malicious remote parties can exploit this to crash the publication server, affecting its availability but not the repository content itself.

Recommendations For versions prior to 0.12.1, update to version 0.12.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/rrdp" endpoint to prevent malicious queries from causing the server to crash.

Correção

Enumeração de Fraquezas

CWE-248

Identificadores relacionados

CVE-2023-0158

Produtos afetados

Nlnet Labs Krill

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-0158 · Nota de Segurança
• https://t.me/cvenotify/42170 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-0158 · Aviso do Fabricante
• https://nlnetlabs.nl/downloads/krill/CVE-2023-0158.txt · Aviso do Fabricante
• https://t.me/cibsecurity/56603 · Publicação no Telegram
• https://t.me/cvenotify/42771 · Publicação no Telegram