CVE-2021-3912 OctoRPKI crashes when processing GZIP bomb returned via malicious repository

What is CVE-2021-3912?

CVE-2021-3912 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 11 Nov 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).

Weakness: CWE-770, CWE-400

Which versions are affected by CVE-2021-3912?

3 open source packages ship an affected version, including github.com/cloudflare/cfrpki. It affects 2 products.

Products include Cloudflare Octorpki, Debian Debian Linux.

How do I fix CVE-2021-3912?

Upgrade github.com/cloudflare/cfrpki to 1.4.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-3912 being exploited?

There is no known exploitation of CVE-2021-3912 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2021-3978 Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki High 7.5
• CVE-2021-3761 OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values High 7.5
• CVE-2021-3907 Arbitrary filepath traversal via URI injection High 7.4
• CVE-2021-3908 Infinite certificate chain depth results in OctoRPKI running forever Medium 5.9
• CVE-2022-3616 OctoRPKI crash when maximum iterations number is reached Medium 5.4

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-3912, GHSA-g9wh-3vrx-r7hg, GO-2022-0253.