GitHub Advisoryadvisory · Go

GHSA-g5gj-9ggf-9vmq Infinite certificate chain depth results in OctoRPKI running forever

MEDIUM Published 2021-11-10 Modified 2023-10-02 Official page ↗
Aliases
CVE-2021-3908
Ecosystem
Go
Packages
github.com/cloudflare/cfrpki
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-835
Reviewed
2021-11-10

Affected packages

• Go github.com/cloudflare/cfrpki: < 1.4.0 → fixed in 1.4.0

Description

OctoRPKI (github.com/cloudflare/cfrpki/cmd/octorpki) does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end. For more information If you have any questions or comments about this advisory email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-3908 OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-835 Loop with Unreachable Exit Condition weakness

References