High severity · published Sep 9, 2021
CVE-2021-3761
Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
11.0 · source: NVD
OC
Octorpki · Cloudflare
before 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3761
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3761
Patch
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-c8xp-8mf3-62h9
Third Party Advisory
https://www.debian.org/security/2022/dsa-5041
More from Octorpki
9.8
CVE-2021-3907
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex
7.5
CVE-2022-3616
OctoRPKI crash when maximum iterations number is reached
7.5
CVE-2021-3910
OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character)
7.5
CVE-2021-3909
OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever
7.5
CVE-2021-3908
OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end