Cloudflare Octorpki
9 CVEs affecting Cloudflare Octorpki. Latest disclosed: 2025-01-29. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3978 | High | 7.5 | 2025-01-29 | When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service def… |
CVE-2021-3761 | High | 7.5 | 2021-09-09 | Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can… |
CVE-2021-3907 | High | 7.4 | 2021-11-11 | OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/e… |
CVE-2021-3908 | Medium | 5.9 | 2021-11-11 | OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end. |
CVE-2022-3616 | Medium | 5.4 | 2022-10-28 | Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash… |
CVE-2021-3910 | Medium | 4.4 | 2021-11-11 | OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character). |
CVE-2021-3909 | Medium | 4.4 | 2021-11-11 | OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repo… |
CVE-2021-3912 | Medium | 4.2 | 2021-11-11 | OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a reposi… |
CVE-2021-3911 | Medium | 4.2 | 2021-11-11 | If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. |