Log in Start free

Vulnerability · Published Nov 9, 2021 · Assigned by NLnet Labs

CVE-2021-43173Hanging RRDP request

High 7.5

In plain English

A high-severity security flaw in Routinator from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.4%top 27.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12cfrpki1.4.0-1DEBIAN-CVE-2021-43173
Debian:12fort-validator1.5.3-1DEBIAN-CVE-2021-43173
Debian:13fort-validator1.5.3-1DEBIAN-CVE-2021-43173
Debian:14fort-validator1.5.3-1DEBIAN-CVE-2021-43173
Debian:12rpki-client7.5-1DEBIAN-CVE-2021-43173
Debian:13rpki-client7.5-1DEBIAN-CVE-2021-43173
Debian:14rpki-client7.5-1DEBIAN-CVE-2021-43173

Affected products (as reported)

VendorProductVersions
NLnet Labs Routinator unspecified – through 0.10.1

Weakness: CWE-755

References