Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/cloudflare/cfrpki

9 known vulnerabilities (3 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 3 high, 6 medium
Registry
pkg.go.dev

Advisories 9

  • Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki

    Affected: fixed in 1.4.2.

  • CVE-2022-3616Medium 5.4

    OctoRPKI crash when maximum iterations number is reached

    Affected: fixed in 1.4.4.

  • CVE-2021-3912Medium 4.2

    OctoRPKI crashes when processing GZIP bomb returned via malicious repository

    Affected: fixed in 1.4.0.

  • CVE-2021-3911Medium 4.2

    Misconfigured IP address field in ROA leads to OctoRPKI crash

    Affected: fixed in 1.4.0.

  • CVE-2021-3910Medium 4.4

    NUL character in ROA causes OctoRPKI to crash

    Affected: fixed in 1.4.0.

  • CVE-2021-3909Medium 4.4

    Infinite open connection causes OctoRPKI to hang forever

    Affected: fixed in 1.4.0.

  • CVE-2021-3908Medium 5.9

    Infinite certificate chain depth results in OctoRPKI running forever

    Affected: fixed in 1.4.0.

  • Arbitrary filepath traversal via URI injection

    Affected: fixed in 1.4.4; fixed in 1.4.3.

  • OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values

    Affected: fixed in 1.3.0.