CVE-2022-3616

NameCVE-2022-3616
DescriptionAttackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cfrpki (PTS)bullseye (security), bullseye1.4.2-1~deb11u1vulnerable
bookworm, sid1.4.4-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cfrpkisource(unstable)1.4.4-1

Notes

https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc

Search for package or bug name: Reporting problems