GitHub Advisoryadvisory · Go

GHSA-3jhm-87m6-x959 Path traversal mitigation bypass in OctoRPKI

HIGH Published 2022-06-25 Modified 2023-10-02 Official page ↗
Ecosystem
Go
Packages
github.com/cloudflare/cfrpki
Severity
High
Weaknesses
CWE-22
Reviewed
2022-06-25

Affected packages

• Go github.com/cloudflare/cfrpki: < 1.4.3 → fixed in 1.4.3

Description

Impact The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder. Specific Go Packages Affected github.com/cloudflare/cfrpki/cmd/octorpki Patches The issue was fixed in version 1.4.3 References CVE-2021-3907

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References