PT-2021-21737 · Octorpki · Octorpki

Job Snijders · Published 2021-09-07 · Updated 2022-07-15 · CVE-2021-3761

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OctoRPKI versions prior to 1.3.0

Description Any CA issuer in the RPKI can trick OctoRPKI into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network, for example AS 13335 - Cloudflare, prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.

Recommendations For OctoRPKI versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the RTR sessions to minimize the risk of exploitation. Avoid using the MaxLength field in the VRP until the issue is resolved.

Fix

Improper Certificate Validation

Memory Corruption

Weakness Enumeration

CWE-295

CWE-787

Related Identifiers

CVE-2021-3761

DSA-5041-1

GHSA-C8XP-8MF3-62H9

GO-2022-0246

Affected Products

Octorpki

References · 18

• https://github.com/cloudflare/cfrpki/security/advisories/GHSA-c8xp-8mf3-62h9 · Patch
• https://osv.dev/vulnerability/GHSA-c8xp-8mf3-62h9 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3761 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3761 · Security Note
• https://debian.org/security/2022/dsa-5041 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3761 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0246 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3761 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3761 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3761 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3761 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5041-1 · Vendor Advisory
• https://github.com/cloudflare/cfrpki/releases/tag/v1.3.0 · Note
• https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422 · Note
• https://github.com/cloudflare/cfrpki/pull/90 · Note