HIGH7.5
GHSA-5mxh-2qfv-4g7j
NUL character in ROA causes OctoRPKI to crash
Quick fix
GHSA-5mxh-2qfv-4g7j — github.com/cloudflare/cfrpki: upgrade to the fixed version with the command below.
go get github.com/cloudflare/cfrpki@v1.4.0Details
OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded `NUL` (`\0`) character).
## Patches
## For more information If you have any questions or comments about this advisory email us at security@cloudflare.com
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/cloudflare/cfrpki
Introduced in:
0Fixed in: 1.4.0Fix
go get github.com/cloudflare/cfrpki@v1.4.0References
- https://github.com/cloudflare/cfrpki/security/advisories/GHSA-5mxh-2qfv-4g7j[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2021-3910[ADVISORY]
- https://github.com/cloudflare/cfrpki/commit/76f0f7a98da001fa04e5bc0407c6702f91096bfa[WEB]
- https://github.com/cloudflare/cfrpki[PACKAGE]
- https://github.com/cloudflare/cfrpki/releases/tag/v1.4.0[WEB]
- https://pkg.go.dev/vuln/GO-2022-0251[WEB]
- https://www.debian.org/security/2022/dsa-5041[WEB]