GHSA-w6ww-fmfx-2x22

Misconfigured IP address field in ROA leads to OctoRPKI crash

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-3911

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/cloudflare/cfrpki	< 1.4.0	1.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. ## Patches ## For more information If you have any questions or comments about this advisory email us at [email protected]

References

External links from the advisory. They lead to third-party sites.

https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22 web
https://nvd.nist.gov/vuln/detail/CVE-2021-3911 advisory
https://github.com/cloudflare/cfrpki/commit/2882307febd66801de97b2a2ce4d93fe58132005 web
https://github.com/cloudflare/cfrpki package
https://pkg.go.dev/vuln/GO-2022-0252 web
https://www.debian.org/security/2022/dsa-5041 web