An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.
References
Link | Resource |
---|---|
https://nicmx.github.io/FORT-validator/CVE.html |
Configurations
No configuration.
History
26 Aug 2024, 16:35
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-476 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
26 Aug 2024, 12:47
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
24 Aug 2024, 23:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-08-24 23:15
Updated : 2024-08-26 16:35
NVD link : CVE-2024-45238
Mitre link : CVE-2024-45238
CVE.ORG link : CVE-2024-45238
JSON object : View
Products Affected
No product.
CWE
CWE-476
NULL Pointer Dereference