CVE-2021-3761
published 2021-09-09CVE-2021-3761: Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.22%
65.5th percentile
Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cloudflare | octorpki | < 1.3.0 | 1.3.0 |
| cloudflare | octorpki | >= unspecified < 1.3.0 | 1.3.0 |
| debian | cfrpki | < cfrpki 1.3.0-1 (bookworm) | cfrpki 1.3.0-1 (bookworm) |
| debian | debian_linux | — | — |
| github.com | cloudflare_cfrpki | >= 0 < 1.3.0 | 1.3.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Insufficient validation in github.com/cloudflare/cfrpki
osv·2022-07-15
CVE-2021-3761 Insufficient validation in github.com/cloudflare/cfrpki
Insufficient validation in github.com/cloudflare/cfrpki
The ROAEntry.Validate function fails to perform bounds checks on the MaxLength field, allowing invalid values to pass validation.
OSV
CVE-2021-3761: Any CA issuer in the RPKI can trick OctoRPKI prior to 1
osv·2021-09-09·CVSS 7.5
CVE-2021-3761 [HIGH] CVE-2021-3761: Any CA issuer in the RPKI can trick OctoRPKI prior to 1
Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
GHSA
OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
ghsa·2021-09-07
CVE-2021-3761 [HIGH] CWE-295 OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
Any CA issuer in the RPKI can trick OctoRPKI prior to https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate.
### Impact
An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
### Patches
https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422
https://github.com/clo
OSV
OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
osv·2021-09-07
CVE-2021-3761 [HIGH] OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
Any CA issuer in the RPKI can trick OctoRPKI prior to https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate.
### Impact
An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
### Patches
https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422
https://github.com/clo
Debian
CVE-2021-3761: cfrpki - Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an inv...
vendor_debian·2021·CVSS 7.5
CVE-2021-3761 [HIGH] CVE-2021-3761: cfrpki - Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an inv...
Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
Scope: local
bookworm: resolved (fixed in 1.3.0-1)
bullseye: resolved (fixed in 1.4.2-1~deb11u1)
No detection rules found.
No public exploits indexed.
2021-09-09
Published