PT-2021-23758 · Nlnet+1 · Routinator+1

Koen Van Der Hove · Published 2021-11-09 · Updated 2022-08-09 · CVE-2021-43173

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NLnet Labs Routinator versions prior to 0.10.2

Description A validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.

Recommendations For NLnet Labs Routinator versions prior to 0.10.2, update to version 0.10.2 or later to resolve the issue. As a temporary workaround, consider adjusting the configurable time-out value for RRDP connections to a lower value to minimize the risk of validation stalling. Additionally, restrict access to RRDP repositories that may be used to exploit this issue until the update is applied.

Fix

Improper Handling of Exceptional Conditions

Resource Exhaustion

Weakness Enumeration

CWE-755

CWE-400

Related Identifiers

CVE-2021-43173

DSA-5033-1

DSA-5041-1

Affected Products

Debian

Routinator

References · 21

• https://nlnetlabs.nl/downloads/routinator/CVE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-43173 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5033-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43173 · Security Note
• https://ubuntu.com/security/CVE-2021-43173 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-43173 · Vendor Advisory
• https://debian.org/security/2021/dsa-5033 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-43173 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43173 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5041-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-43173 · Security Note
• https://github.com/NLnetLabs/routinator/pull/612 · Note
• https://github.com/NLnetLabs/routinator/pull/666 · Note
• https://t.me/cvenotify/23181 · Telegram Post