PT-2022-20049 · Nlnet · Routinator

Donika Mirdita + 1 · Published 2022-09-13 · Updated 2022-09-16 · CVE-2022-3029

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NLnet Labs Routinator versions 0.9.0 through 0.11.2

Description The issue arises from a mistake in error handling, where data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error, causing Routinator to exit. This can lead to a denial of service for the RPKI data that Routinator provides to routers, potentially stopping networks from validating route origins based on RPKI data. However, this issue does not allow an attacker to manipulate RPKI data.

Recommendations For NLnet Labs Routinator versions 0.9.0 through 0.11.2, consider updating to a version where this error handling issue is fixed, as the current version can cause Routinator to exit due to incorrectly base 64 encoded data in RRDP files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Assertion Failure

Weakness Enumeration

CWE-617

CWE-241

Related Identifiers

CVE-2022-3029

GHSA-M4VX-CCRF-W399

Affected Products

Routinator

References · 9

• https://osv.dev/vulnerability/GHSA-m4vx-ccrf-w399 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3029 · Security Note
• https://nlnetlabs.nl/downloads/routinator/CVE-2022-3029.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3029 · Vendor Advisory
• https://github.com/NLnetLabs/routinator · Note
• https://github.com/NLnetLabs/routinator/pull/781/commits/c2e2476f28f09ea5ffb22d172d84fb4f8384d496 · Note
• https://github.com/NLnetLabs/routinator/releases/tag/v0.11.3 · Note
• https://t.me/cvenotify/36100 · Telegram Post
• https://t.me/cibsecurity/49671 · Telegram Post