CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43172 – Infinite length chain of RRDP repositories
https://notcve.org/view.php?id=CVE-2021-43172
NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a new child CA that only consists of another CA using a different RRDP repository, a malicious CA can create a chain of CAs of de-facto infinite length. Routinator prior to version 0.10.2 did not contain a limit on the length of such a chain and will therefore continue to process this chain forever. As a result, the validation run will never finish, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all. • https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt • CWE-674: Uncontrolled Recursion CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41531 – Invalid RPKI data could disable Route Origin Validation on RTR clients.
https://notcve.org/view.php?id=CVE-2021-41531
NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to RTR clients such as routers to reject the RPKI data set, effectively disabling Route Origin Validation. NLnet Labs Routinator versiones anteriores a 0.10.0, produce una carga útil RTR no válida si una CA RPKI usa valores demasiado grandes en el parámetro de longitud máxima en un ROA. Esto conlleva a que los clientes RTR, como los enrutadores, rechacen el conjunto de datos RPKI, deshabilitando efectivamente la Comprobación del Origen de Ruta • https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-41531.txt • CWE-20: Improper Input Validation CWE-1288: Improper Validation of Consistency within Input •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-17366
https://notcve.org/view.php?id=CVE-2020-17366
An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509 Certificate Revocation List files from the RPKI relying party's view. Se detectó un problema en NLnet Labs Routinator versiones 0.1.0 hasta 0.7.1. Permite a atacantes remotos omitir las restricciones de acceso previstas o causar una denegación de servicio en los sistemas de enrutamiento dependientes al retener estratégicamente los archivos ".roa" Route Origin Authorisation de RPKI o los archivos de la Lista de Revocación de Certificados X509 desde la vista de la parte que confía en RPKI • https://github.com/NLnetLabs/routinator/issues/319 https://github.com/NLnetLabs/routinator/releases/tag/v0.8.0 • CWE-295: Improper Certificate Validation •