CVE-2021-3911 - Vulnerability Details - OpenCVE

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00555.

Key SSVC decision points have not yet been added.

Vendors	Products
Cloudflare Subscribe	Octorpki Subscribe
Debian Subscribe	Debian Linux Subscribe

Configuration 1 [-]

cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
Debian DSA	DSA-5041-1	cfrpki security update
EUVD	EUVD-2021-2404	If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
Github GHSA	GHSA-w6ww-fmfx-2x22	Misconfigured IP address field in ROA leads to OctoRPKI crash

Fixes

Solution

Upgrade to 1.4

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22
https://www.debian.org/security/2022/dsa-5041

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: cloudflare

Published: 2021-11-11T21:45:22.690851Z

Updated: 2024-09-16T22:31:10.731Z

Reserved: 2021-10-26T00:00:00

Link: CVE-2021-3911

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-11-11T22:15:08.023

Modified: 2024-11-21T06:22:45.577

Link: CVE-2021-3911

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"containers": {"cna": {"affected": [{"product": "octorpki", "vendor": "Cloudflare", "versions": [{"lessThan": "1.4.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Koen van Hove"}], "datePublic": "2021-11-01T00:00:00", "descriptions": [{"lang": "en", "value": "If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-01-12T10:06:22", "orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "shortName": "cloudflare"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22"}, {"name": "DSA-5041", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2022/dsa-5041"}], "solutions": [{"lang": "en", "value": "Upgrade to 1.4"}], "source": {"discovery": "EXTERNAL"}, "title": "Misconfigured IP address field in ROA leads to OctoRPKI crash", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@cloudflare.com", "DATE_PUBLIC": "2021-11-01T22:52:00.000Z", "ID": "CVE-2021-3911", "STATE": "PUBLIC", "TITLE": "Misconfigured IP address field in ROA leads to OctoRPKI crash"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "octorpki", "version": {"version_data": [{"version_affected": "<", "version_value": "1.4.0"}]}}]}, "vendor_name": "Cloudflare"}]}}, "credit": [{"lang": "eng", "value": "Koen van Hove"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20 Improper Input Validation"}]}]}, "references": {"reference_data": [{"name": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22", "refsource": "MISC", "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22"}, {"name": "DSA-5041", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2022/dsa-5041"}]}, "solution": [{"lang": "en", "value": "Upgrade to 1.4"}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:09:09.604Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22"}, {"name": "DSA-5041", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2022/dsa-5041"}]}]}, "cveMetadata": {"assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "assignerShortName": "cloudflare", "cveId": "CVE-2021-3911", "datePublished": "2021-11-11T21:45:22.690851Z", "dateReserved": "2021-10-26T00:00:00", "dateUpdated": "2024-09-16T22:31:10.731Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:*", "matchCriteriaId": "A39C112F-E066-40D1-9CAC-9D9F89B467EE", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash."}, {"lang": "es", "value": "Si el ROA que devuelve un repositorio contiene demasiados bits para la direcci\u00f3n IP, OctoRPKI ser\u00e1 bloqueado"}], "id": "CVE-2021-3911", "lastModified": "2024-11-21T06:22:45.577", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 3.6, "source": "cna@cloudflare.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-11-11T22:15:08.023", "references": [{"source": "cna@cloudflare.com", "tags": ["Third Party Advisory"], "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22"}, {"source": "cna@cloudflare.com", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2022/dsa-5041"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2022/dsa-5041"}], "sourceIdentifier": "cna@cloudflare.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "cna@cloudflare.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-252"}], "source": "nvd@nist.gov", "type": "Primary"}]}