OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb,
    unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and
    thus crash). (CVE-2021-3912)

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5041 advisory.

    Multiple vulnerabilities were discovered in Cloudflare's RPKI validator, which could result in denial of     service or path traversal. For the stable distribution (bullseye), these problems have been fixed in     version 1.4.2-1~deb11u1. We recommend that you upgrade your cfrpki packages. For the detailed security     status of cfrpki please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/cfrpki

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
415044	SCA: security update for github.com/cloudflare/cfrpki (GHSA-g9wh-3vrx-r7hg)	Tenable Cloud Security	SCA Checks	medium
415044	SCA: security update for github.com/cloudflare/cfrpki (GHSA-g9wh-3vrx-r7hg)	Tenable Self-Hosted Container Security	SCA Checks	medium
156636	Debian DSA-5041-1 : cfrpki - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2021-3912

medium

Tenable Plugins

medium

medium

critical