GitHub Advisoryadvisory · Go

GHSA-g9wh-3vrx-r7hg OctoRPKI crashes when processing GZIP bomb returned via malicious repository

MEDIUM Published 2021-11-10 Modified 2021-11-10 Official page ↗
Aliases
CVE-2021-3912
Ecosystem
Go
Packages
github.com/cloudflare/cfrpki
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2021-11-10

Affected packages

• Go github.com/cloudflare/cfrpki: < 1.4.0 → fixed in 1.4.0

Description

OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash). Patches For more information If you have any questions or comments about this advisory email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-3912 OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References