If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
    (CVE-2021-3911)

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5041 advisory.

    Multiple vulnerabilities were discovered in Cloudflare's RPKI validator, which could result in denial of     service or path traversal. For the stable distribution (bullseye), these problems have been fixed in     version 1.4.2-1~deb11u1. We recommend that you upgrade your cfrpki packages. For the detailed security     status of cfrpki please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/cfrpki

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
419762	SCA: security update for github.com/cloudflare/cfrpki (GHSA-w6ww-fmfx-2x22)	Tenable Cloud Security	SCA Checks	medium
419762	SCA: security update for github.com/cloudflare/cfrpki (GHSA-w6ww-fmfx-2x22)	Tenable Self-Hosted Container Security	SCA Checks	medium
156636	Debian DSA-5041-1 : cfrpki - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2021-3911

medium

Tenable Plugins

medium

medium

critical