Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Cloudflare octorpki 1.4.0 Clear all filters
TI-2021-02822 CVE-2021-3912 · GHSA-g9wh-3vrx-r7hg

OctoRPKI crashes when processing GZIP bomb returned via malicious repository

Priority LOW 30

OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0085 Published 2021-11-11 Fixed in 1.4.0 CWE-400
TI-2021-02820 CVE-2021-3910 · GHSA-5mxh-2qfv-4g7j

NUL character in ROA causes OctoRPKI to crash

Priority LOW 35

OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01212 Published 2021-11-11 Fixed in 1.4.0 CWE-20
TI-2021-02818 CVE-2021-3908 · GHSA-g5gj-9ggf-9vmq

Infinite certificate chain depth results in OctoRPKI running forever

Priority LOW 34

OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00731 Published 2021-11-11 Fixed in 1.4.0 CWE-400