FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-19 20:48:44 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
9c990e67-6e30-11ec-82db-b42e991fc52eroutinator -- multiple vulnerabilities

nlnetlabs reports:

Release 0.10.2 contains fixes for the following issues:

  • Medium CVE-2021-43172: Infinite length chain of RRDP repositories. Credit: Koen van Hove. Date: 2021-11-09
  • Medium CVE-2021-43173: Hanging RRDP request. Credit: Koen van Hove. Date: 2021-11-09
  • Medium CVE-2021-43174: gzip transfer encoding caused out-of-memory crash. Credit Koen van Hove. Date: 2021-11-09

Discovery 2021-11-09
Entry 2022-01-05
routinator
< 0.10.1

CVE-2021-43172
CVE-2021-43173
CVE-2021-43174
https://nlnetlabs.nl/projects/rpki/security-advisories/
e4133d8b-ab33-451a-bc68-3719de73d54aroutinator -- potential DOS attack

Due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst case impact of this vulnerability is denial of service for the RPKI data that Routinator provides to routers. This may stop your network from validating route origins based on RPKI data. This vulnerability does not allow an attacker to manipulate RPKI data. We are not aware of exploitation of this vulnerability at this point in time. Starting with release 0.11.3, Routinator handles encoding errors by rejecting the snapshot or delta file and continuing with validation. In case of an invalid delta file, it will try using the snapshot instead. If a snapshot file is invalid, the update of the repository will fail and an update through rsync is attempted.

.


Discovery 2022-10-06
Entry 2022-10-07
routinator
ge 0.9.0 lt 0.11.3

CVE-2022-3029
https://nlnetlabs.nl/downloads/routinator/CVE-2022-3029.txt