Vulnerability · Published Aug 24, 2024 · Assigned by mitre
CVE-2024-45238
High 7.5
In plain English
A high-severity null pointer dereference in the fort-validator package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | fort-validator | 1.5.4-1+deb12u1 | DEBIAN-CVE-2024-45238 |
| Debian:13 | fort-validator | 1.6.3-1 | DEBIAN-CVE-2024-45238 |
| Debian:14 | fort-validator | 1.6.3-1 | DEBIAN-CVE-2024-45238 |
| Ubuntu:22.04:LTS | fort-validator | 1.5.3-1ubuntu0.1 | USN-7813-1 |
| Ubuntu:22.04:LTS | fort-validator | 1.5.3-1ubuntu0.1 | UBUNTU-CVE-2024-45238 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H