Vulnerability · Published Nov 11, 2021 · Assigned by cloudflare
CVE-2021-3907Arbitrary filepath traversal via URI injection
High 7.4
In plain English
A high-severity improper input validation in octorpki from Cloudflare. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cfrpki | 1.4.0-1 | DEBIAN-CVE-2021-3907 |
| Debian:12 | fort-validator | 1.5.3-1 | DEBIAN-CVE-2021-3907 |
| Debian:13 | fort-validator | 1.5.3-1 | DEBIAN-CVE-2021-3907 |
| Debian:14 | fort-validator | 1.5.3-1 | DEBIAN-CVE-2021-3907 |
| Go | github.com/cloudflare/cfrpki | 1.4.4 | GHSA-cqh2-vc2f-q4fh |
| Go | github.com/cloudflare/cfrpki | 1.4.4 | GO-2022-0248 |
| Go | github.com/cloudflare/cfrpki | 1.4.3 | GHSA-8459-6rc9-8vf8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloudflare | octorpki | unspecified – before 1.4.3 |
Weakness: CWE-20, CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
References
- https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh x_refsource_MISC
- DSA-5033 vendor-advisory, x_refsource_DEBIAN
- DSA-5041 vendor-advisory, x_refsource_DEBIAN
- https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959 x_refsource_MISC