CVE-2024-45238

Name	CVE-2024-45238
Description	An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4066-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fort-validator (PTS)	bullseye	1.5.3-1~deb11u1	vulnerable
	bullseye (security)	1.5.3-1~deb11u2	fixed
	bookworm	1.5.4-1	vulnerable
	sid, trixie	1.6.6-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
fort-validator	source	bullseye	1.5.3-1~deb11u2		DLA-4066-1
fort-validator	source	(unstable)	1.6.3-1

Notes

[bookworm] - fort-validator <no-dsa> (Will be fixed via spu)
https://nicmx.github.io/FORT-validator/CVE.html
https://github.com/NICMx/FORT-validator/commit/5689dea5e878fed28c5f338a27d7cda4151a14f1 (1.6.3)