CVE-2021-3978 Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki

What is CVE-2021-3978?

CVE-2021-3978 is a high-severity vulnerability in Cloudflare octorpki, published on 29 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root ( https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service ) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation.

Weakness: CWE-269

Which versions are affected by CVE-2021-3978?

3 open source packages ship an affected version, including github.com/cloudflare/cfrpki. It affects 1 product.

Products include Cloudflare Octorpki.

How do I fix CVE-2021-3978?

Upgrade github.com/cloudflare/cfrpki to 1.4.2 or later.

Is CVE-2021-3978 being exploited?

There is no known exploitation of CVE-2021-3978 in the wild and no public exploit code.

Other vulnerabilities in Cloudflare octorpki

• CVE-2021-3761 OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values High 7.5
• CVE-2021-3907 Arbitrary filepath traversal via URI injection High 7.4
• CVE-2021-3908 Infinite certificate chain depth results in OctoRPKI running forever Medium 5.9
• CVE-2022-3616 OctoRPKI crash when maximum iterations number is reached Medium 5.4
• CVE-2021-3909 Infinite open connection causes OctoRPKI to hang forever Medium 4.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-3978, GHSA-3pqh-p72c-fj85, GO-2022-0580.