PT-2021-22384 · Octorpki · Octorpki

Haynespls · Published 2021-11-10 · Updated 2022-08-09 · CVE-2021-3912

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OctoRPKI (affected versions not specified)

Description The issue allows an attacker to create a repository that can cause OctoRPKI to run out of memory and crash. This is possible because OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, it unzips it in memory. The HTTPFetcher.GetXML function reads a response of unlimited size into memory, permitting resource exhaustion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2021-3912

DSA-5041-1

GHSA-G9WH-3VRX-R7HG

GO-2022-0253

Affected Products

Octorpki

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2021-3912 · Security Note
• https://debian.org/security/2022/dsa-5041 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3912 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3912 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0253 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3912 · Security Note
• https://osv.dev/vulnerability/GHSA-g9wh-3vrx-r7hg · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3912 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3912 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3912 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5041-1 · Vendor Advisory
• https://github.com/cloudflare/cfrpki/security/advisories/GHSA-g9wh-3vrx-r7hg · Note
• https://github.com/cloudflare/cfrpki/commit/648658b1b176a747b52645989cfddc73a81eacad · Note
• https://github.com/cloudflare/cfrpki/commit/32961e7a41cae67660dfee92095a1f6c2f86f943 · Note
• https://pkg.go.dev/vuln/GO-2022-0253 · Note