CVE-2021-3911 Misconfigured IP address field in ROA leads to OctoRPKI crash

What is CVE-2021-3911?

CVE-2021-3911 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 11 Nov 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.

Weakness: CWE-252, CWE-20

Which versions are affected by CVE-2021-3911?

3 open source packages ship an affected version, including github.com/cloudflare/cfrpki. It affects 2 products.

Products include Cloudflare Octorpki, Debian Debian Linux.

How do I fix CVE-2021-3911?

Upgrade github.com/cloudflare/cfrpki to 1.4.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-3911 being exploited?

There is no known exploitation of CVE-2021-3911 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2021-3978 Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki High 7.5
• CVE-2021-3761 OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values High 7.5
• CVE-2021-3907 Arbitrary filepath traversal via URI injection High 7.4
• CVE-2021-3908 Infinite certificate chain depth results in OctoRPKI running forever Medium 5.9
• CVE-2022-3616 OctoRPKI crash when maximum iterations number is reached Medium 5.4

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-3911, GHSA-w6ww-fmfx-2x22, GO-2022-0252.