CVE-2024-45238: Null Pointer Dereference
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45238?
CVE-2024-45238 has been classified as a medium severity vulnerability due to its potential to compromise resource certificate validation.
How do I fix CVE-2024-45238?
To fix CVE-2024-45238, upgrade Fort to version 1.6.3 or later and ensure OpenSSL is updated to version 3 or higher.
What versions of Fort are affected by CVE-2024-45238?
CVE-2024-45238 affects all versions of Fort prior to 1.6.3.
What versions of OpenSSL are impacted by CVE-2024-45238?
CVE-2024-45238 impacts OpenSSL versions prior to 3.
What is the impact of exploiting CVE-2024-45238?
Exploitation of CVE-2024-45238 could allow an attacker to serve a malicious resource certificate, potentially leading to unauthorized access to systems relying on the affected software.