GitHub Advisoryadvisory · Go

GHSA-w6ww-fmfx-2x22 Misconfigured IP address field in ROA leads to OctoRPKI crash

MEDIUM Published 2021-11-10 Modified 2021-11-10 Official page ↗
Aliases
CVE-2021-3911
Ecosystem
Go
Packages
github.com/cloudflare/cfrpki
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-252
Reviewed
2021-11-10

Affected packages

• Go github.com/cloudflare/cfrpki: < 1.4.0 → fixed in 1.4.0

Description

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. Patches For more information If you have any questions or comments about this advisory email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-3911 If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-252 Unchecked Return Value weakness

References