MEDIUM4.2
GHSA-w6ww-fmfx-2x22
Misconfigured IP address field in ROA leads to OctoRPKI crash
Quick fix
GHSA-w6ww-fmfx-2x22 — github.com/cloudflare/cfrpki: upgrade to the fixed version with the command below.
go get github.com/cloudflare/cfrpki@v1.4.0Details
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
## Patches
## For more information If you have any questions or comments about this advisory email us at security@cloudflare.com
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/cloudflare/cfrpki
Introduced in:
0Fixed in: 1.4.0Fix
go get github.com/cloudflare/cfrpki@v1.4.0References
- https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2021-3911[ADVISORY]
- https://github.com/cloudflare/cfrpki/commit/2882307febd66801de97b2a2ce4d93fe58132005[WEB]
- https://github.com/cloudflare/cfrpki[PACKAGE]
- https://pkg.go.dev/vuln/GO-2022-0252[WEB]
- https://www.debian.org/security/2022/dsa-5041[WEB]