PT-2020-14785 · Ripe Ncc · Ripe Ncc Rpki Validator

Published 2020-07-30 · Updated 2024-08-04 · CVE-2020-16163

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions RIPE NCC RPKI Validator versions 3.x before 3.1-2020.07.06.14.28

Description An issue was discovered in the RIPE NCC RPKI Validator where RRDP fetches proceed even with a lack of validation of a TLS HTTPS endpoint. This allows remote attackers to bypass intended access restrictions, or to trigger denial of service to traffic directed to co-dependent routing systems. It is noted that third parties assert the behavior is intentionally permitted by RFC 8182.

Recommendations For versions 3.x before 3.1-2020.07.06.14.28, consider updating to version 3.1-2020.07.06.14.28 or later to resolve the issue. As a temporary workaround, consider restricting access to the RRDP fetch functionality until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-16163

Affected Products

Ripe Ncc Rpki Validator

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-16163 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16163 · Vendor Advisory
• https://github.com/RIPE-NCC/rpki-validator-3/issues/159 · Note
• https://t.me/cvenotify/88987 · Telegram Post