CVE-2021-3909: Infinite open connection causes OctoRPKI to hang forever
OctoRPKI (github.com/cloudflare/cfrpki/cmd/octorpki) does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.
Patches
For more information If you have any questions or comments about this advisory email us at security@cloudflare.com
Other sources
OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-3909?
CVE-2021-3909 is a vulnerability in OctoRPKI that allows for a slowloris DOS attack.
How does CVE-2021-3909 impact OctoRPKI?
CVE-2021-3909 allows an attacker to perform a slowloris DOS attack on OctoRPKI, causing it to wait forever.
What is the severity of CVE-2021-3909?
CVE-2021-3909 has a severity rating of high (7.5).
Which software versions are affected by CVE-2021-3909?
The affected software versions include OctoRPKI 1.3.0 up to, but not including, 1.4.0, cfrpki 1.4.0, 1.4.2-1~deb11u1, 1.4.4-1, 1.5.10-2, fort-validator 1.5.3-1~deb11u1, 1.5.4-1, and rpki-client 8.2-2, 8.6-1.
How can CVE-2021-3909 be fixed?
To fix CVE-2021-3909, update OctoRPKI to version 1.4.0 or later, cfrpki to version 1.4.0, 1.4.2-1~deb11u1, 1.4.4-1, or 1.5.10-2, fort-validator to version 1.5.3-1~deb11u1 or 1.5.4-1, and rpki-client to version 8.2-2 or 8.6-1.