Donika Mirdita

**Name of the Vulnerable Software and Affected Versions** NLnet Labs' bcder library versions 0.7.2 and earlier **Description** The bcder library panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding. **Recommendations** For versions 0.7.2 and earlier, update to version 0.7.3 or later, which fixes the issue by more thoroughly checking inputs and returning errors as expected. As a temporary workaround, consider implementing additional input validation to prevent the library from panicking when encountering invalid data.

**Name of the Vulnerable Software and Affected Versions** Routinator versions up to and including 0.12.1 **Description** The issue is caused by insufficient input checking in the bcder library, which may lead to a crash when trying to parse certain malformed RPKI objects. **Recommendations** For versions up to and including 0.12.1, update to a version that includes the fix for the insufficient input checking in the bcder library to prevent crashes when parsing malformed RPKI objects. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Routinator versions 0.9.0 through 0.12.1 **Description** The issue concerns a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature of Routinator. This feature allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for an attacker to craft a URL that results in the response being stored outside of the directory specified for it. **Recommendations** For Routinator versions 0.9.0 through 0.12.1, consider disabling the keep-rrdp-responses feature until a patch is available to prevent potential path traversal attacks. Restrict access to the directory where responses are stored to minimize the risk of exploitation. Avoid using the keep-rrdp-responses feature with untrusted RRDP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Routinator versions 0.9.0 through 0.11.2 **Description** The issue arises from a mistake in error handling, where data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error, causing Routinator to exit. This can lead to a denial of service for the RPKI data that Routinator provides to routers, potentially stopping networks from validating route origins based on RPKI data. However, this issue does not allow an attacker to manipulate RPKI data. **Recommendations** For NLnet Labs Routinator versions 0.9.0 through 0.11.2, consider updating to a version where this error handling issue is fixed, as the current version can cause Routinator to exit due to incorrectly base 64 encoded data in RRDP files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.