CVE-2024-45235: Null Pointer Dereference

First published: Sat Aug 24 2024(Updated: )

An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field. Fort references this pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.

Credit: cve@mitre.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/references
• agent/description
• agent/type
• agent/first-publish-date
• agent/author
• collector/nvd-api
• source/NVD
• agent/last-modified-date
• agent/severity
• agent/weakness
• agent/event
• collector/mitre-cve
• source/MITRE
• agent/source
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• agent/tags
• agent/softwarecombine
• vendor/fort
• canonical/fortinet fortigate