Vulnerability · Published Nov 11, 2021 · Assigned by cloudflare
CVE-2021-3909Infinite open connection causes OctoRPKI to hang forever
Medium 4.4
In plain English
A medium-severity uncontrolled resource consumption in octorpki from Cloudflare. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cfrpki | 1.4.0-1 | DEBIAN-CVE-2021-3909 |
| Debian:12 | fort-validator | 1.5.3-1 | DEBIAN-CVE-2021-3909 |
| Debian:13 | fort-validator | 1.5.3-1 | DEBIAN-CVE-2021-3909 |
| Debian:14 | fort-validator | 1.5.3-1 | DEBIAN-CVE-2021-3909 |
| Debian:12 | rpki-client | 7.5-1 | DEBIAN-CVE-2021-3909 |
| Debian:13 | rpki-client | 7.5-1 | DEBIAN-CVE-2021-3909 |
| Debian:14 | rpki-client | 7.5-1 | DEBIAN-CVE-2021-3909 |
| Go | github.com/cloudflare/cfrpki | 1.4.0 | GHSA-8cvr-4rrf-f244 |
| Go | github.com/cloudflare/cfrpki | 1.4.0 | GO-2022-0250 |
| Ubuntu:22.04:LTS | cfrpki | 1.4.2-1 | UBUNTU-CVE-2021-3909 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloudflare | octorpki | unspecified – before 1.4.0 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/cloudflare/cfrpki/security/advisories/GHSA-8cvr-4rrf-f244 x_refsource_MISC
- DSA-5033 vendor-advisory, x_refsource_DEBIAN
- DSA-5041 vendor-advisory, x_refsource_DEBIAN