CVE-2022-3616: OctoRPKI crash when maximum iterations number is reached
Impact Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.
Specific Go Packages Affected github.com/cloudflare/cfrpki/cmd/octorpki
Patches This issue is fixed in v1.4.4
Workarounds None.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-3616.
What is the impact of this vulnerability?
This vulnerability can cause OctoRPKI to exceed its max iterations parameter, leading to a denial of service.
What is the severity rating for this vulnerability?
The severity rating for this vulnerability is high, with a value of 7.5.
How can attackers exploit this vulnerability?
Attackers can create long chains of CAs to trigger the vulnerability and cause a denial of service.
Is there a patch available for this vulnerability?
Yes, a patch is available for this vulnerability in version 1.4.4 of the Cloudflare Octorpki package.