OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
References
Link | Resource |
---|---|
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959 | Third Party Advisory |
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh | Third Party Advisory |
https://www.debian.org/security/2021/dsa-5033 | Third Party Advisory |
https://www.debian.org/security/2022/dsa-5041 | Third Party Advisory |
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959 | Third Party Advisory |
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh | Third Party Advisory |
https://www.debian.org/security/2021/dsa-5033 | Third Party Advisory |
https://www.debian.org/security/2022/dsa-5041 | Third Party Advisory |
Configurations
History
21 Nov 2024, 06:22
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 7.4 |
References | () https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959 - Third Party Advisory | |
References | () https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh - Third Party Advisory | |
References | () https://www.debian.org/security/2021/dsa-5033 - Third Party Advisory | |
References | () https://www.debian.org/security/2022/dsa-5041 - Third Party Advisory |
23 Jun 2022, 12:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
04 Apr 2022, 13:46
Type | Values Removed | Values Added |
---|---|---|
References | (DEBIAN) https://www.debian.org/security/2022/dsa-5041 - Third Party Advisory | |
References | (DEBIAN) https://www.debian.org/security/2021/dsa-5033 - Third Party Advisory | |
CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
12 Jan 2022, 11:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
31 Dec 2021, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
16 Nov 2021, 15:20
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh - Third Party Advisory | |
CWE | CWE-22 | |
CPE | cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
12 Nov 2021, 16:28
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-11-11 22:15
Updated : 2024-11-21 06:22
NVD link : CVE-2021-3907
Mitre link : CVE-2021-3907
CVE.ORG link : CVE-2021-3907
JSON object : View
Products Affected
cloudflare
- octorpki
debian
- debian_linux