Vulnerability · Published Nov 11, 2021 · Assigned by cloudflare
CVE-2021-3911Misconfigured IP address field in ROA leads to OctoRPKI crash
Medium 4.2
In plain English
A medium-severity improper input validation in octorpki from Cloudflare. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.9%top 39.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cfrpki | 1.4.0-1 | DEBIAN-CVE-2021-3911 |
| Go | github.com/cloudflare/cfrpki | 1.4.0 | GHSA-w6ww-fmfx-2x22 |
| Go | github.com/cloudflare/cfrpki | 1.4.0 | GO-2022-0252 |
| Ubuntu:22.04:LTS | cfrpki | 1.4.2-1 | UBUNTU-CVE-2021-3911 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloudflare | octorpki | unspecified – before 1.4.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
References
- https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22 x_refsource_MISC
- DSA-5041 vendor-advisory, x_refsource_DEBIAN