CVE-2022-3616

NameCVE-2022-3616
DescriptionAttackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cfrpki (PTS)bullseye (security), bullseye1.4.2-1~deb11u1vulnerable
bookworm1.4.4-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cfrpkisource(unstable)1.4.4-1

Notes

[bullseye] - cfrpki <no-dsa> (Minor issue)
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc

Search for package or bug name: Reporting problems