Vulnerability · Published Nov 9, 2021 · Assigned by NLnet Labs
CVE-2021-43174gzip transfer encoding caused out-of-memory crash
High 7.5
In plain English
A high-severity security flaw in Routinator from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cfrpki | 1.4.0-1 | DEBIAN-CVE-2021-43174 |
| Ubuntu:22.04:LTS | cfrpki | 1.4.2-1 | UBUNTU-CVE-2021-43174 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NLnet Labs | Routinator | unspecified – through 0.10.1 |
Weakness: CWE-1325
References
- https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt x_refsource_MISC
- DSA-5041 vendor-advisory, x_refsource_DEBIAN