CVE-2021-3909: falha de média gravidade em Cloudflare octorpki
Infinite open connection causes OctoRPKI to hang forever
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.4epss 1.6%
OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Cloudflare · octorpkiCVEs relacionadas — Cloudflare octorpki
No mesmo produto, das mais perigosas para as menos.
CVE-2021-3907HIGHArbitrary filepath traversal via URI injectionEPSS 4.2%CVE-2021-3761HIGHOctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength valuesEPSS 1.2%CVE-2021-3910MEDIUMNUL character in ROA causes OctoRPKI to crashEPSS 1.2%CVE-2021-3911MEDIUMMisconfigured IP address field in ROA leads to OctoRPKI crashEPSS 0.9%CVE-2021-3912MEDIUMOctoRPKI crashes when processing GZIP bomb returned via malicious repositoryEPSS 0.9%CVE-2021-3908MEDIUMInfinite certificate chain depth results in OctoRPKI running foreverEPSS 0.7%